)]}'
{
  "log": [
    {
      "commit": "8e936331b6fa5c4b28ba356a10a518ea72b20ba4",
      "tree": "db03b8dfdb3042b588ad6ee9407c9e2bd153a6a2",
      "parents": [
        "07137b91fc0ca3b8b7a5577c20ca96fd55c89dd5"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Fri Oct 23 15:39:55 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 23 13:09:55 2026 +0530"
      },
      "message": "fix(ci): pin Python 3.8 and C++ jobs to Ubuntu 24.04 (#4193)\n\n`ubuntu-latest` now resolves to Ubuntu 26.04, where\n`actions/setup-python` cannot install Python 3.8/3.9 x64. Pin the\naffected compiler, Java, OpenJ9, integration, JavaScript, Python, Go,\nand formatting jobs to Ubuntu 24.04 while retaining their Python/Node\nversions, matrix coverage, and test commands.\n\nKeep C++ and sanitizer jobs on the same Ubuntu 24.04 baseline: the image\nmigration also introduced GCC 15 build failures and incompatible cached\nBazel toolchain paths in main CI. Compiler warnings and sanitizer\ncoverage remain enabled.\n\nValidation: Python 3.8 compiler import, workflow YAML lint, Prettier,\nand structural matrix comparison passed. The official Python\ndistribution manifest confirms Ubuntu 24.04 builds for every selected\nPython version. Remote CI is being verified on this PR."
    },
    {
      "commit": "07137b91fc0ca3b8b7a5577c20ca96fd55c89dd5",
      "tree": "6d4fafc84ce66c597fd8f112bf2740128a0e6485",
      "parents": [
        "80bcf64e68defb2de70e8e9047a1bb5f5d050883"
      ],
      "author": {
        "name": "Durgesh Nandan Mohanty",
        "email": "durgeshnandanmohanty@gmail.com",
        "time": "Fri Oct 23 06:38:16 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 23 09:08:16 2026 +0800"
      },
      "message": "fix(cpp): resolve sign-compare warning in row writer (#4192)\n\nThis PR resolves a -Wsign-compare warning in writer.cc by applying a\nstatic_cast\u003cuint64_t\u003e to fixed_part_bytes before comparing it against\ndata_size"
    },
    {
      "commit": "80bcf64e68defb2de70e8e9047a1bb5f5d050883",
      "tree": "008ca8b9ed05c1d42c15c327dfb45375bfdd0ad4",
      "parents": [
        "a11d257b4d68571a0e3d528e2117506f716bc4db"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Oct 21 08:08:24 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 21 08:08:24 2026 +0530"
      },
      "message": "ci: Bump the github-actions group with 2 updates (#4189)\n\nBumps the github-actions group with 2 updates:\n[bazel-contrib/setup-bazel](https://github.com/bazel-contrib/setup-bazel)\nand [sbt/setup-sbt](https://github.com/sbt/setup-sbt).\n\nUpdates `bazel-contrib/setup-bazel` from 0.19.0 to 0.19.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/releases\"\u003ebazel-contrib/setup-bazel\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.19.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: crash when printing warning by \u003ca\nhref\u003d\"https://github.com/lurtz\"\u003e\u003ccode\u003e@​lurtz\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/154\"\u003ebazel-contrib/setup-bazel#154\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.14.1 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/153\"\u003ebazel-contrib/setup-bazel#153\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​actions/github\u003c/code\u003e to\nv9.1.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/155\"\u003ebazel-contrib/setup-bazel#155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.15.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/157\"\u003ebazel-contrib/setup-bazel#157\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add cache-restore-timeout to cap entire restore operation by\n\u003ca href\u003d\"https://github.com/mani-muon\"\u003e\u003ccode\u003e@​mani-muon\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/156\"\u003ebazel-contrib/setup-bazel#156\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.16.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/165\"\u003ebazel-contrib/setup-bazel#165\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​actions/cache\u003c/code\u003e to\nv6.0.1 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/164\"\u003ebazel-contrib/setup-bazel#164\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency \u003ccode\u003e@​actions/glob\u003c/code\u003e to ^0.7.0\nby \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/160\"\u003ebazel-contrib/setup-bazel#160\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency yaml to v2.9.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/161\"\u003ebazel-contrib/setup-bazel#161\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​actions/github\u003c/code\u003e to\nv9.1.1 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/159\"\u003ebazel-contrib/setup-bazel#159\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update actions/setup-node action to v7 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/172\"\u003ebazel-contrib/setup-bazel#172\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency \u003ccode\u003e@​vercel/ncc\u003c/code\u003e to ^0.44.0 by\n\u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/167\"\u003ebazel-contrib/setup-bazel#167\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.18.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/168\"\u003ebazel-contrib/setup-bazel#168\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update actions/checkout action to v7 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/170\"\u003ebazel-contrib/setup-bazel#170\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​actions/cache\u003c/code\u003e to\nv6.2.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/169\"\u003ebazel-contrib/setup-bazel#169\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.18.1 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/173\"\u003ebazel-contrib/setup-bazel#173\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.20.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/174\"\u003ebazel-contrib/setup-bazel#174\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(deps): update dependency \u003ccode\u003e@​vercel/ncc\u003c/code\u003e to ^0.45.0 by\n\u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/175\"\u003ebazel-contrib/setup-bazel#175\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update node.js to v24.21.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/176\"\u003ebazel-contrib/setup-bazel#176\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency \u003ccode\u003e@​actions/cache\u003c/code\u003e to\nv6.3.0 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/178\"\u003ebazel-contrib/setup-bazel#178\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): update dependency yaml to v2.9.1 by \u003ca\nhref\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e@​renovate\u003c/code\u003e\u003c/a\u003e[bot] in\n\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/177\"\u003ebazel-contrib/setup-bazel#177\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lurtz\"\u003e\u003ccode\u003e@​lurtz\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/154\"\u003ebazel-contrib/setup-bazel#154\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mani-muon\"\u003e\u003ccode\u003e@​mani-muon\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/pull/156\"\u003ebazel-contrib/setup-bazel#156\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/compare/0.19.0...0.19.1\"\u003ehttps://github.com/bazel-contrib/setup-bazel/compare/0.19.0...0.19.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/104e3eea9447cdaa4b00d0fb46191a3985d26ab3\"\u003e\u003ccode\u003e104e3ee\u003c/code\u003e\u003c/a\u003e\nRelease 0.19.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/0114cb1ac2feab72b715547276d90ae93a250be3\"\u003e\u003ccode\u003e0114cb1\u003c/code\u003e\u003c/a\u003e\nchore(deps): update dependency yaml to v2.9.1 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/177\"\u003e#177\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/c077f7f4f84534a3ba3e375effef7c31fe30e096\"\u003e\u003ccode\u003ec077f7f\u003c/code\u003e\u003c/a\u003e\nchore(deps): update dependency \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.3.0\n(\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/178\"\u003e#178\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/2c206a1fbe8810c10784264cfbb6a0c1e201d1db\"\u003e\u003ccode\u003e2c206a1\u003c/code\u003e\u003c/a\u003e\nchore(deps): update node.js to v24.21.0 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/176\"\u003e#176\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/e98ce48e0716b20c3ad257e2411269d91d169e5c\"\u003e\u003ccode\u003ee98ce48\u003c/code\u003e\u003c/a\u003e\nfix(deps): update dependency \u003ccode\u003e@​vercel/ncc\u003c/code\u003e to ^0.45.0 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/175\"\u003e#175\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/c1cfa6ff83172a0f1d03c64fa3bd9575c203fb3d\"\u003e\u003ccode\u003ec1cfa6f\u003c/code\u003e\u003c/a\u003e\nchore(deps): update node.js to v24.20.0 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/174\"\u003e#174\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/5bab119910beb57b5848d5090ee6d35c031fb26e\"\u003e\u003ccode\u003e5bab119\u003c/code\u003e\u003c/a\u003e\nchore(deps): update node.js to v24.18.1 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/173\"\u003e#173\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/ef83a47c92d639a5dbf729d2f87b17b4ecf9f655\"\u003e\u003ccode\u003eef83a47\u003c/code\u003e\u003c/a\u003e\nchore(deps): update dependency \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.2.0\n(\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/169\"\u003e#169\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/5ff9bef0b4c692895dbbfeda0d7c1b7ba3ee14e3\"\u003e\u003ccode\u003e5ff9bef\u003c/code\u003e\u003c/a\u003e\nchore(deps): update actions/checkout action to v7 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/170\"\u003e#170\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/commit/46d9ed7f2488f2fed83699182a594b660c535d10\"\u003e\u003ccode\u003e46d9ed7\u003c/code\u003e\u003c/a\u003e\nchore(deps): update node.js to v24.18.0 (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/setup-bazel/issues/168\"\u003e#168\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/bazel-contrib/setup-bazel/compare/c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86...104e3eea9447cdaa4b00d0fb46191a3985d26ab3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sbt/setup-sbt` from 1.5.11 to 1.5.12\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/releases\"\u003esbt/setup-sbt\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.5.12\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate sbt to 2.0.10 by \u003ca\nhref\u003d\"https://github.com/scala-steward\"\u003e\u003ccode\u003e@​scala-steward\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/pull/146\"\u003esbt/setup-sbt#146\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/pull/144\"\u003esbt/setup-sbt#144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/pull/148\"\u003esbt/setup-sbt#148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/upload-artifact from 7.0.1 to 7.0.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/pull/147\"\u003esbt/setup-sbt#147\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/compare/v1.5.11...v1.5.12\"\u003ehttps://github.com/sbt/setup-sbt/compare/v1.5.11...v1.5.12\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/ecad189dd245444b9ae0a0cd5922fd938b88906f\"\u003e\u003ccode\u003eecad189\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/issues/147\"\u003e#147\u003c/a\u003e\nfrom sbt/dependabot/github_actions/actions/upload-art...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/b8252f9a4e1b597bba05b0307cd6db0e88adf009\"\u003e\u003ccode\u003eb8252f9\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/issues/148\"\u003e#148\u003c/a\u003e\nfrom sbt/dependabot/github_actions/github/codeql-acti...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/785f7941a064b31438d70064e33f71f6055661a5\"\u003e\u003ccode\u003e785f794\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/c9916c0f37981023bc198da6d584b259a7a5c644\"\u003e\u003ccode\u003ec9916c0\u003c/code\u003e\u003c/a\u003e\nBump actions/upload-artifact from 7.0.1 to 7.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/6d9172c6419fd513f3789fb6098467c5511bb333\"\u003e\u003ccode\u003e6d9172c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/issues/146\"\u003e#146\u003c/a\u003e\nfrom scala-steward/update/sbt-2.0.10\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/7dcba54c172a11ce913cae1727964a767ca19dc5\"\u003e\u003ccode\u003e7dcba54\u003c/code\u003e\u003c/a\u003e\nRegenerated action.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/743f6b6be86bbec76f4c2bc66f9daffb51c9a1f5\"\u003e\u003ccode\u003e743f6b6\u003c/code\u003e\u003c/a\u003e\nUpdate sbt to 2.0.10\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/bb6aa91de37caf721c0047a598ce0a75242631b2\"\u003e\u003ccode\u003ebb6aa91\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/issues/144\"\u003e#144\u003c/a\u003e\nfrom sbt/dependabot/github_actions/github/codeql-acti...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/1291dd4f4d853a3b16217ed1cb5d452b691433b3\"\u003e\u003ccode\u003e1291dd4\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/compare/6158cb0903b8ceeae04f830055f3155e1b6a5ad7...ecad189dd245444b9ae0a0cd5922fd938b88906f\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a11d257b4d68571a0e3d528e2117506f716bc4db",
      "tree": "25c6c81e7af6dbad6c81541137099b7addcb1115",
      "parents": [
        "7e9d416bc1fb1fcfe33540f4b747b87129887397"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 11:37:39 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 11:37:39 2026 +0530"
      },
      "message": "chore: Bump MessagePack from 2.5.301 to 2.5.303 (#4184)\n\nUpdated\n[MessagePack](https://github.com/MessagePack-CSharp/MessagePack-CSharp)\nfrom 2.5.301 to 2.5.303.\n\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\n_Sourced from [MessagePack\u0027s\nreleases](https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases)._\n\n## 2.5.303\n\n## Security Fix\n\n* Fix [Nested arrays can blow past buffer length\nlimits](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-qhrr-8q5h-9q3h)\nvia 7fd78bbf3476\n\n**Full Changelog**:\nhttps://github.com/MessagePack-CSharp/MessagePack-CSharp/compare/v2.5.302...v2.5.303\n\n## 2.5.302\n\nThis is a merge release, combining the security fix from the\nhttps://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.205\nrelease with the several security fixes from the\nhttps://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.301\nrelease.\n\nCommits viewable in [compare\nview](https://github.com/MessagePack-CSharp/MessagePack-CSharp/compare/v2.5.301...v2.5.303).\n\u003c/details\u003e\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dMessagePack\u0026package-manager\u003dnuget\u0026previous-version\u003d2.5.301\u0026new-version\u003d2.5.303)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "7e9d416bc1fb1fcfe33540f4b747b87129887397",
      "tree": "fdf809183d8eb5e687a0f2a01bd6527a9c3cd04b",
      "parents": [
        "d8ed8643ed66ab7c7874c70dea2e0a407ccfdeb6"
      ],
      "author": {
        "name": "Mohit Joshi",
        "email": "joshionmohit@gmail.com",
        "time": "Fri Oct 16 06:37:25 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:07:25 2026 +0800"
      },
      "message": "fix(rust): replace unmaintained paste crate (#4183)\n\n## Why?\n\n`cargo-deny` reported the unmaintained `paste` crate\n(`RUSTSEC-2024-0436`) in the Rust dependency graph in issue #4182 .\n\n## What does this PR do?\n\n- Replaces the unmaintained `paste` package with the maintained `pastey`\npackage through Cargo package renaming.\n- Keeps the local dependency name as `paste`, so the existing\n`$crate::paste::paste!` macro calls remain unchanged.\n- Changes only `rust/fory-core/Cargo.toml`.\n- No serializer, generated-code, protocol, runtime, or public API source\nfiles were changed.\n\nValidation:\n\n- `cargo test -p fory-core trait_visibility_forms_compile --\n--nocapture` — passed (`1 passed, 0 failed`).\n- `cargo clippy --workspace --all-features --all-targets -- -D warnings`\n— passed.\n- `cargo tree --workspace | Select-String \"paste\"` — shows `pastey\nv0.2.3` and no `paste` crate.\n- `cargo deny check` — reports `advisories ok`, `bans ok`, and `sources\nok`. The overall command reports license failures because this checkout\nhas no `deny.toml` and cargo-deny uses its default license policy.\n- `cargo test --workspace` — all crates compiled, but one unrelated\nexisting test, `types::temporal::tests::std_time_conversions`, failed in\n`rust/fory-core/src/types/temporal.rs`.\n\nResult: \n\u003cimg width\u003d\"1013\" height\u003d\"119\" alt\u003d\"Screenshot 2026-10-16 040523\"\nsrc\u003d\"https://github.com/user-attachments/assets/1cef663d-c2c5-4e39-b4ba-8471ae48163d\"\n/\u003e\n\u003cimg width\u003d\"1301\" height\u003d\"492\" alt\u003d\"Screenshot 2026-10-16 040516\"\nsrc\u003d\"https://github.com/user-attachments/assets/4d966246-56d8-4385-8b6e-0bff321dc7c0\"\n/\u003e\n\n\n## Related issues\n\nFixes #4182\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [ ] If `yes`, I included a completed AI Contribution Checklist and the\nrequired AI Usage Disclosure.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and final clean review evidence from both required reviewers.\n\n## AI Usage Disclosure\n\n- substantial_ai_assistance: yes\n- scope: dependency migration, validation commands, and PR description\ndrafting\n- affected_files_or_subsystems: `rust/fory-core/Cargo.toml`\n- ai_review: Not completed yet\n- ai_review_artifacts: Not available yet\n- human_verification: Focused macro test passed, Clippy passed, and\ndependency tree confirmed `pastey` with no `paste`.\n- performance_verification: Not applicable; this is a manifest-only\ndependency replacement.\n- provenance_license_confirmation: No source code was copied from third\nparties. The replacement dependency uses the maintained `pastey`\npackage.\n\n### Completed AI Review Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] If `yes`, I included the standardized `AI Usage Disclosure` block\nabove.\n- [ ] If `yes`, I can explain and defend all important changes without\nAI help.\n- [ ] If `yes`, I reviewed AI-assisted code changes line by line before\nsubmission.\n- [ ] If `yes`, I completed line-by-line self-review first and fixed\nissues before requesting AI review.\n- [ ] If `yes`, I ran two fresh AI review agents on the current PR diff\nor current HEAD after the latest code changes: one Fory-guided reviewer\nand one independent general reviewer.\n- [ ] If `yes`, I addressed all actionable AI review comments and\nrepeated the review loop until both AI reviewers reported no further\nactionable comments.\n- [ ] If `yes`, I attached screenshot evidence or equivalent persisted\nlinks of the final clean-review results from both reviewers in this PR\nbody.\n- [x] If `yes`, I ran a focused test command and recorded its result\nabove.\n- [x] If `yes`, I added regression tests for the reported issue.\n- [ ] If `yes`, I validated protocol and performance impacts; no binary\nprotocol change was introduced.\n- [ ] If `yes`, I verified licensing and provenance compliance.\n\n## Does this PR introduce any user-facing change?\n\nThis PR does not introduce any user-facing behavior, public API, or\nbinary protocol changes.\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\nNot applicable. This is a manifest-only dependency replacement and does\nnot change serialization logic or runtime behavior.\n\nCo-authored-by: Copilot \u003c223556219+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "d8ed8643ed66ab7c7874c70dea2e0a407ccfdeb6",
      "tree": "0ccc7e000db32a14279c82969be89fb8d465eeb5",
      "parents": [
        "9cc2a6ac07064529b099a1a4f96dec3f553461f3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 15 09:15:06 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 15 09:15:06 2026 +0530"
      },
      "message": "ci: Bump the github-actions group across 1 directory with 4 updates (#4181)\n\nBumps the github-actions group with 4 updates in the / directory:\n[apache/infrastructure-actions/allowlist-check](https://github.com/apache/infrastructure-actions),\n[gradle/actions/setup-gradle](https://github.com/gradle/actions),\n[graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm) and\n[sbt/setup-sbt](https://github.com/sbt/setup-sbt).\n\nUpdates `apache/infrastructure-actions/allowlist-check` from\nbddab88ea4e4874c2c159c18f3017b51ec278d03 to\ne3e0a2261a9c6d5bdd882802b303f34b1511b6df\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/e3e0a2261a9c6d5bdd882802b303f34b1511b6df\"\u003e\u003ccode\u003ee3e0a22\u003c/code\u003e\u003c/a\u003e\nRemove Expired Refs\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/1a529f6db9a40ded1cc91759e638ef3e1b39b7b5\"\u003e\u003ccode\u003e1a529f6\u003c/code\u003e\u003c/a\u003e\nSync actions.yml, composite action, and approved_patterns.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/94cbf4fddc3c73ff413eb107e23a272cdc5e90c8\"\u003e\u003ccode\u003e94cbf4f\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/apache/infrastructure-actions/issues/1383\"\u003e#1383\u003c/a\u003e\nfrom jprinet/allowlist-develocity-v2.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/2af048a126d7df8febe5e31217740ec885b8b4ef\"\u003e\u003ccode\u003e2af048a\u003c/code\u003e\u003c/a\u003e\nAdd gradle/develocity-actions setup-npm and setup-python, bump to\nv2.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/b1b1ab191498302581efdef55279706f79249c0e\"\u003e\u003ccode\u003eb1b1ab1\u003c/code\u003e\u003c/a\u003e\nRemove Expired Refs\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/955e87054e303ccabdfb55ad097eb0a9b7060401\"\u003e\u003ccode\u003e955e870\u003c/code\u003e\u003c/a\u003e\nSync actions.yml, composite action, and approved_patterns.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/454b0612175a8cc288d2724ef688d358aae8e538\"\u003e\u003ccode\u003e454b061\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/apache/infrastructure-actions/issues/1382\"\u003e#1382\u003c/a\u003e\nfrom apache/dependabot/github_actions/dot-github/act...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/ecb1de7022f372eff2011e8ba96b04c18a23319a\"\u003e\u003ccode\u003eecb1de7\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/apache/infrastructure-actions/issues/1381\"\u003e#1381\u003c/a\u003e\nfrom apache/dependabot/github_actions/dot-github/act...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/b10fadaf2aa57db41bf96ce32ca4265cb076150c\"\u003e\u003ccode\u003eb10fada\u003c/code\u003e\u003c/a\u003e\naction-allowlist-review: bump loadingalias/cargo-rail-action\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/commit/cef1fb21532c9c901157db07e4d2ef05e115ae1a\"\u003e\u003ccode\u003ecef1fb2\u003c/code\u003e\u003c/a\u003e\naction-allowlist-review: bump pypa/cibuildwheel\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/infrastructure-actions/compare/bddab88ea4e4874c2c159c18f3017b51ec278d03...e3e0a2261a9c6d5bdd882802b303f34b1511b6df\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gradle/actions/setup-gradle` from 6.3.0 to 6.4.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/gradle/actions/releases\"\u003egradle/actions/setup-gradle\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.4.0\u003c/h2\u003e\n\u003ch2\u003eHighlights\u003c/h2\u003e\n\u003ch3\u003eGradle version support status in the Job Summary\u003c/h3\u003e\n\u003cp\u003eThe actions now report the support status of every Gradle version\nused in a workflow, as job\nannotations and in the Job Summary (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1057\"\u003e#1057\u003c/a\u003e).\nThanks to \u003ca href\u003d\"https://github.com/ov7a\"\u003e\u003ccode\u003e@​ov7a\u003c/code\u003e\u003c/a\u003e for\nthe contribution.\u003c/p\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eversion kind\u003c/th\u003e\n\u003cth\u003ejob annotation\u003c/th\u003e\n\u003cth\u003eversion table\u003c/th\u003e\n\u003cth\u003ebelow the table\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eEnd-of-life\u003c/strong\u003e — two or more major versions behind the\nlatest release\u003c/td\u003e\n\u003ctd\u003ewarning\u003c/td\u003e\n\u003ctd\u003e:warning:\u003c/td\u003e\n\u003ctd\u003eexpandable section naming the affected release lines, pointing at\nthe \u003ca href\u003d\"https://gradle.org/security-subscription/\"\u003eGradle Security\nSubscription\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eOut of date\u003c/strong\u003e — one major behind, or more than two\nminors behind on the current major\u003c/td\u003e\n\u003ctd\u003enotice\u003c/td\u003e\n\u003ctd\u003e:information_source:\u003c/td\u003e\n\u003ctd\u003eone-line legend pointing at the \u003ca\nhref\u003d\"https://docs.gradle.org/current/userguide/feature_lifecycle.html#eol_support\"\u003eGradle\nrelease lifecycle\u003c/a\u003e docs\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eCurrent\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003enone\u003c/td\u003e\n\u003ctd\u003e—\u003c/td\u003e\n\u003ctd\u003e—\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eDeliberately \u003cem\u003enot\u003c/em\u003e reported: patch releases (being on\n\u003ccode\u003e9.7.0\u003c/code\u003e when \u003ccode\u003e9.7.1\u003c/code\u003e exists is not flagged) and\npre-releases (release candidates, milestones and snapshots never produce\nannotations). The latest\nGradle release is determined from the wrapper checksum data already\nbundled with the action, so no\nnetwork access is required.\u003c/p\u003e\n\u003cp\u003eNote that these annotations are emitted independently of the\n\u003ccode\u003eadd-job-summary\u003c/code\u003e setting: setting\n\u003ccode\u003eadd-job-summary: \u0027never\u0027\u003c/code\u003e suppresses the Job Summary itself,\nbut the warning and notice annotations\nremain.\u003c/p\u003e\n\u003ch3\u003eGradle itself is now reported in the dependency graph\u003c/h3\u003e\n\u003cp\u003eThe \u003ccode\u003edependency-submission\u003c/code\u003e action now applies\n\u003cstrong\u003ev1.5.0\u003c/strong\u003e of the\n\u003ca\nhref\u003d\"https://github.com/gradle/github-dependency-graph-gradle-plugin\"\u003eGitHub\nDependency Graph Gradle Plugin\u003c/a\u003e\n(up from v1.4.2) (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1069\"\u003e#1069\u003c/a\u003e).\u003c/p\u003e\n\u003cp\u003eThe headline change is that the Gradle Build Tool running the build\nis now reported as an\n\u003ccode\u003eorg.gradle:gradle-core\u003c/code\u003e dependency, so that \u003cstrong\u003eGitHub\ncan surface known vulnerabilities in the version\nof Gradle used to run your build\u003c/strong\u003e. These are the coordinates\nthat GitHub advisories for the Gradle\nBuild Tool are published against.\u003c/p\u003e\n\u003cp\u003eDetails worth knowing:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe entry is always reported as a \u003cstrong\u003edirect\u003c/strong\u003e dependency\nwith \u003cstrong\u003edevelopment\u003c/strong\u003e scope.\u003c/li\u003e\n\u003cli\u003eIt is \u003cstrong\u003enot\u003c/strong\u003e affected by the project, configuration or\nscope filters, so it appears even in graphs\nthat filter aggressively.\u003c/li\u003e\n\u003cli\u003eExpect dependency graphs to gain this one new entry the first time a\nbuild runs after upgrading.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eA new Gradle signing key, if you use dependency verification\u003c/h3\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nIf your build has \u003ca\nhref\u003d\"https://docs.gradle.org/current/userguide/dependency_verification.html#sec:signature-verification\"\u003edependency\nverification\u003c/a\u003e\nenabled, you must add a \u003cstrong\u003esecond\u003c/strong\u003e trusted key before\nupgrading, or Dependency Graph generation will\nfail signature verification.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003ccode\u003egithub-dependency-graph-gradle-plugin\u003c/code\u003e \u003ccode\u003e1.5.0\u003c/code\u003e\nis signed with a new Gradle signing subkey, and the\nkey previously documented in our setup guide has been revoked\nupstream:\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/3f5f9adaf7d9fecd50b5935e54106014257a94e6\"\u003e\u003ccode\u003e3f5f9ad\u003c/code\u003e\u003c/a\u003e\nDocument the new Gradle signing key for dependency verification (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1071\"\u003e#1071\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/b031f6d1a92a4611986643414591f8f649182940\"\u003e\u003ccode\u003eb031f6d\u003c/code\u003e\u003c/a\u003e\n[bot] Update dist directory\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/5bc4175609b5adc59007637c78e2eb52125bea3d\"\u003e\u003ccode\u003e5bc4175\u003c/code\u003e\u003c/a\u003e\nBump dependency-graph-gradle-plugin to 1.5.0 (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1069\"\u003e#1069\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/f3ff59b4e4151fd189d67647ccb7b78ddde26db9\"\u003e\u003ccode\u003ef3ff59b\u003c/code\u003e\u003c/a\u003e\nCombined automated updates: wrapper checksums, npm dependencies,\nsetup-java (...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/7927085475f60c9d4b43880590e265597c31d8b4\"\u003e\u003ccode\u003e7927085\u003c/code\u003e\u003c/a\u003e\nUpdate .tool-versions: node 24.18.0, gradle 9.7.1, java 17 (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1068\"\u003e#1068\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/c3897a4e73a8f23b849f1980944785e7ae34c471\"\u003e\u003ccode\u003ec3897a4\u003c/code\u003e\u003c/a\u003e\n[bot] Update dist directory\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/6b92be19055d28f8f52e00bd24bb215841656af4\"\u003e\u003ccode\u003e6b92be1\u003c/code\u003e\u003c/a\u003e\nUpdate dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1065\"\u003e#1065\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/0d208da0581aab8a4c6c02b69957a02c7806bca8\"\u003e\u003ccode\u003e0d208da\u003c/code\u003e\u003c/a\u003e\n[bot] Update dist directory\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/e49d0a36a8651e7efb23918f4532fe1d4f46de77\"\u003e\u003ccode\u003ee49d0a3\u003c/code\u003e\u003c/a\u003e\nReport EOL and maintenance status for Gradle versions (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1057\"\u003e#1057\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/actions/commit/575435b1ea5344b0885c3387acd4752bca7a57b7\"\u003e\u003ccode\u003e575435b\u003c/code\u003e\u003c/a\u003e\nUse the root-qualified \u003ccode\u003e:wrapper\u003c/code\u003e task (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/actions/issues/1064\"\u003e#1064\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/gradle/actions/compare/9c971963bec38e04b3d30dcc455b5382be2fdbfb...3f5f9adaf7d9fecd50b5935e54106014257a94e6\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `graalvm/setup-graalvm` from 1.6.6 to 1.6.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/releases\"\u003egraalvm/setup-graalvm\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.6.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​humanfs/node\u003c/code\u003e from 0.16.7 to 0.16.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/graalvm/setup-graalvm/pull/238\"\u003egraalvm/setup-graalvm#238\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.28.0 to 6.29.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/graalvm/setup-graalvm/pull/240\"\u003egraalvm/setup-graalvm#240\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the all group with 13 updates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/graalvm/setup-graalvm/pull/242\"\u003egraalvm/setup-graalvm#242\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003e25i-latest\u003c/code\u003e for the latest GraalVM innovation\nrelease. by \u003ca\nhref\u003d\"https://github.com/fniephaus\"\u003e\u003ccode\u003e@​fniephaus\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/graalvm/setup-graalvm/pull/243\"\u003egraalvm/setup-graalvm#243\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/compare/v1.6.6...v1.6.7\"\u003ehttps://github.com/graalvm/setup-graalvm/compare/v1.6.6...v1.6.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/27b360dbb857524eaf0b4c4cef364d38e5b4f173\"\u003e\u003ccode\u003e27b360d\u003c/code\u003e\u003c/a\u003e\nBump version to \u003ccode\u003e1.6.7\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/5465633bb8caf726b26c908a15c593f36a6324ef\"\u003e\u003ccode\u003e5465633\u003c/code\u003e\u003c/a\u003e\nDocument \u003ccode\u003e25i-latest\u003c/code\u003e and update \u003ccode\u003eREADME.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/975bdb0ae257ea7116b260f65516f53733cb220e\"\u003e\u003ccode\u003e975bdb0\u003c/code\u003e\u003c/a\u003e\nAdd support for \u003ccode\u003e25i-latest\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/311f4dfa20b8d1822383a93c74fcd0c94feee05f\"\u003e\u003ccode\u003e311f4df\u003c/code\u003e\u003c/a\u003e\nDrop misleading notes.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/9df65ca9b4fb6e33a702f731dd97fc8237fa5d5a\"\u003e\u003ccode\u003e9df65ca\u003c/code\u003e\u003c/a\u003e\nOnly run \u003ccode\u003etest-action-extensive\u003c/code\u003e with\n\u003ccode\u003eGDS_TOKEN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/cd60bef4336b130ef7ec09605c2854b1f7a4a6fa\"\u003e\u003ccode\u003ecd60bef\u003c/code\u003e\u003c/a\u003e\nBump the all group with 13 updates\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/8b5fb996acd8818270fa29fd0493288941c922f3\"\u003e\u003ccode\u003e8b5fb99\u003c/code\u003e\u003c/a\u003e\nFix \u003ccode\u003efetchArtifactByJavaVersion\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/eebbe526aceb69e76cc10658a18a37a9a5e0369b\"\u003e\u003ccode\u003eeebbe52\u003c/code\u003e\u003c/a\u003e\nUpdate to latest 17 CPU.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/cce64d5a59e33a68123bf680ec92e0cb8afa87b7\"\u003e\u003ccode\u003ecce64d5\u003c/code\u003e\u003c/a\u003e\nRun \u003ccode\u003enpm audit fix \u0026amp;\u0026amp; npm run bundle\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/commit/f21c44e5febf0d315b10e1a5244847525e606afd\"\u003e\u003ccode\u003ef21c44e\u003c/code\u003e\u003c/a\u003e\nBump undici from 6.28.0 to 6.29.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/graalvm/setup-graalvm/compare/0426e2e191540e8514dff98dc52a5f5146a2a276...27b360dbb857524eaf0b4c4cef364d38e5b4f173\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sbt/setup-sbt` from 1.5.10 to 1.5.11\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/releases\"\u003esbt/setup-sbt\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.5.11\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePin upload-sarif by \u003ca\nhref\u003d\"https://github.com/eed3si9n\"\u003e\u003ccode\u003e@​eed3si9n\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/pull/140\"\u003esbt/setup-sbt#140\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRevert \u0026quot;Bump carabiner-dev/actions/ampel/verify from 1.2.9 to\n1.3.0\u0026quot; by \u003ca\nhref\u003d\"https://github.com/eed3si9n\"\u003e\u003ccode\u003e@​eed3si9n\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/pull/143\"\u003esbt/setup-sbt#143\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/compare/v1.5.10...v1.5.11\"\u003ehttps://github.com/sbt/setup-sbt/compare/v1.5.10...v1.5.11\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/6158cb0903b8ceeae04f830055f3155e1b6a5ad7\"\u003e\u003ccode\u003e6158cb0\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/issues/143\"\u003e#143\u003c/a\u003e\nfrom sbt/wip/revert\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/8cb6771be4046f1b7bf7b3dc731eb2551cb70f6e\"\u003e\u003ccode\u003e8cb6771\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Bump carabiner-dev/actions/ampel/verify from 1.2.9 to\n1.3.0\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/7d7aa1b166d44716fe4fad3be6d3049298734c36\"\u003e\u003ccode\u003e7d7aa1b\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/sbt/setup-sbt/issues/140\"\u003e#140\u003c/a\u003e\nfrom sbt/wip/bump-action\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/commit/887dea5794ac170e84c55007db79861a31ee8037\"\u003e\u003ccode\u003e887dea5\u003c/code\u003e\u003c/a\u003e\nPin upload-sarif\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/sbt/setup-sbt/compare/ce95da69b39609ea153bad087708da5f37366897...6158cb0903b8ceeae04f830055f3155e1b6a5ad7\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "9cc2a6ac07064529b099a1a4f96dec3f553461f3",
      "tree": "b5049318a87852253ace5fadb31b3cfbb86fbf87",
      "parents": [
        "eb525feccb153b0505f75f4100514b092fb3985c"
      ],
      "author": {
        "name": "ooiuuii",
        "email": "al3060388206@gmail.com",
        "time": "Mon Oct 12 22:40:53 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 13 11:10:53 2026 +0530"
      },
      "message": "fix(compiler): reject conflicting Python field names (#4175)\n\n## Summary\n\nFixes #4174. Python code generation previously allowed distinct schema\nfields such as `class` and `class_` to produce the same dataclass\nattribute, silently overwriting a field and its tag.\n\nKeep the existing keyword escape (`class` becomes `class_`) and preserve\nalready-suffixed names (`class_` and `class__` stay unchanged). Reject\nfields in the same message that collide after snake_case conversion and\nescaping, including nested messages. The diagnostic identifies the\noriginal fields, generated attribute, and available source location, and\nasks the schema author to rename a field.\n\nExisting helper-name suffix conventions remain unchanged. Tests and the\ngenerated-code guide cover the collision errors and stable\nnon-conflicting names. Numeric field tags and wire encoding are\nunchanged.\n\n## Validation\n\n- Regression tests on the previous implementation: 44 failed, 21 passed.\n- `ENABLE_FORY_DEBUG_OUTPUT\u003d1 python3 -m pytest\nfory_compiler/tests/test_python_generator.py -q`: 65 passed.\n- `ENABLE_FORY_DEBUG_OUTPUT\u003d1 python3 -m pytest fory_compiler/tests -q`:\n580 passed, 1 existing unknown-option warning.\n- CLI check: conflicting `class` / `class_` fields exit with an error\nand source location; non-conflicting `class_` / `class__` fields retain\ntheir names and numeric tags.\n- Ruff formatting and lint, Prettier, and `git diff --check`: passed.\n\nLocal validation used CPython 3.9.6 on macOS. The generated-class unit\ntests use a pyfory stub; no native serialization roundtrip is claimed.\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "eb525feccb153b0505f75f4100514b092fb3985c",
      "tree": "90ae5678ebac3df80de14aa42a0f8246472da020",
      "parents": [
        "8b27a2d54c74b577a05155e0d94691dcf8007fa9"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Oct 13 13:40:12 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 13 11:10:12 2026 +0530"
      },
      "message": "feat(rust): support strings and slices in smart pointers (#4176)\n\n## Why?\n\n\n## What does this PR do?\n\n\n## Related issues\n\nCloses #4171 \n\n## AI Contribution Checklist\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n## Does this PR introduce any user-facing change?\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "8b27a2d54c74b577a05155e0d94691dcf8007fa9",
      "tree": "ce5efc4a97fe3a58f79d50efe211d835f8d48499",
      "parents": [
        "7a68b8c16657ca8c052c44fa8bee4d8de0febaf4"
      ],
      "author": {
        "name": "Mohit Joshi",
        "email": "25btcs080@iiitu.ac.in",
        "time": "Tue Oct 13 07:36:07 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 13 07:36:07 2026 +0530"
      },
      "message": "docs: fix grammar and spelling errors in CONTRIBUTING.md (#4173)\n\n## Why?\n\nThe contribution guide contains several grammatical and spelling errors\nthat can be corrected to improve readability.\n\n## What does this PR do?\n\n- Fixes grammatical errors in `CONTRIBUTING.md`.\n- Corrects spelling mistakes.\n- Improves sentence clarity while preserving the original technical\ninstructions.\n\n## Related issues\n\nCloses #4172 \n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes` / `no`\n- [x] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [x] If `yes`, my PR description includes the required `ai_review`\nsummary and evidence from both fresh reviewers, as described in\n`AI_POLICY.md`.\n\n## Does this PR introduce any user-facing change?\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?"
    },
    {
      "commit": "7a68b8c16657ca8c052c44fa8bee4d8de0febaf4",
      "tree": "6a4452e9f96c16bf44d9c7c38d8c4bc6e2f25aad",
      "parents": [
        "b6023929b979b68f77f1ee0ad379c1ec64d58a2f"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Oct 12 16:54:48 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 12 14:24:48 2026 +0530"
      },
      "message": "chore: update release references to 1.7.7 (#4167)\n\nUpdate installation documentation and examples to Apache Fory 1.7.7,\nincluding the Kotlin JSON runtime and KSP READMEs. Add the 1.7.7 Dart\nchangelog entries while retaining the existing 1.8.0 development\nversions in build and package metadata.\n\nValidation: reviewed version forms and remaining references, formatted\nchanged Markdown with Prettier, and passed `git diff --check`. Local\nbuilds and tests were not run for this version-only update."
    },
    {
      "commit": "b6023929b979b68f77f1ee0ad379c1ec64d58a2f",
      "tree": "83f86a98e15c3d95b602d1ba716df9b8a34e586e",
      "parents": [
        "d7ebfa7878b188d9e88216137363399ab5afbe36"
      ],
      "author": {
        "name": "Emrul",
        "email": "emrul@emrul.com",
        "time": "Sat Oct 10 04:27:11 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 08:57:11 2026 +0530"
      },
      "message": "fix(csharp): publish consistent metadata cache snapshots (#4152)\n\nFixes #4151.\n\n### Why?\n\nDuring cross-platform testing of our Aster project we discovered the\n.NET suite failing tests that otherwise succeeded on Python, Go, Rust,\nJava and TypeScript. Upon further investigation we traced the issue to\nApache Fory and had an AI agent investigate the root cause and identify\na possible fix. Root cause is identified as Fory with a full\nreproduction/regression example and a proposed fix is offered.\n\n### Proposed fix and regression tests\n\nC# compatible-mode decoding can silently return `Count\u003d0, Message\u003d\"\"`\nfrom a valid payload containing `Count\u003d37, Message\u003d\"correct\"` during\nconcurrent reads. Reproduced against Fory **1.7.6 release source** and\nmain at `261dc92eabdc5c0fe08748a3ba476ae13f4e8bc9`.\n\nThe proposed fix publishes resolver version and metadata hashes in one\nimmutable snapshot, retains it locally for each read, and compares the\nincoming metadata header directly. No public API or wire-format change.\n\n`MetadataPublicationTests` covers first use, independent codecs, and\nschema replacement, each with reference tracking off/on. Real annotated\nmodels run through the generator; controlled cases add scheduling hooks\nonly to generated test code. Corresponding baseline instrumentation\nreproduced default-valued fields; all six fixed cases pass.\n\n### Validation\n\n- C# suite: **383 passed**; C# xlang suite: **107 passed**; Release\nbuild and formatting passed.\n- Exact patched 1.7.6 package validated on macOS ARM64 and Linux x64.\nThe contributor reports successful independent Aster testing and has\ncompleted human line-by-line review of this exact diff.\n- Existing validation commands: from `csharp/`,\n`ENABLE_FORY_DEBUG_OUTPUT\u003d1 dotnet test Fory.sln -c Release`, `dotnet\nbuild Fory.sln -c Release --no-restore`, and `dotnet format Fory.sln\n--verify-no-changes`; from `java/fory-core/`, `FORY_CSHARP_JAVA_CI\u003d1\nENABLE_FORY_DEBUG_OUTPUT\u003d1 mvn -T16 test\n-Dtest\u003dorg.apache.fory.xlang.CSharpXlangTest` after the Java\nprerequisite build.\n\nWarm single-codec median paired deltas were -0.580% (no refs) and\n-0.810% (refs), with unchanged 144 B/decode. Cache replacement allocates\n40 bytes; first-codec allocation increases by 16 bytes. Cold ref timing\nwas +1.480% paired / +0.869% median-to-median; a small cold-start\nregression is not ruled out. [Full validation, commands and benchmark\nrecord](https://forge.emrul.dev/Aster/fory/src/commit/1c45217452cb4d006411fa81916f0532591f4bb1/docs/fory-patches.md).\n\n### AI Usage Disclosure\n\n- substantial_ai_assistance: **yes** — implementation, tests, validation\nand technical text; affected subsystem: C# generator metadata caching.\n- ai_review: contributor confirmed line-by-line review first; two fresh\nclean-context reviewers then reviewed current HEAD\n`345e4c771ccb4a895181fe8cb244ef2b27fb0196`. Both reported **no further\nactionable comments**, with no code changes afterward.\n- ai_review_artifacts: [Fory-guided\nreview](https://github.com/aster-rpc/fory/pull/2#issuecomment-6079600698),\n[independent general\nreview](https://github.com/aster-rpc/fory/pull/2#issuecomment-6079604462).\nThe independent reviewer did not load the Fory review\nworkflow/checklist.\n- human_verification: contributor completed line-by-line review and\npersonally verified the passing upstream [C#\nCI](https://github.com/apache/fory/actions/runs/37921486739/job/113790208720),\n[C# Xlang\nTest](https://github.com/apache/fory/actions/runs/37921486739/job/113790208702),\nand [Code Style\nCheck](https://github.com/apache/fory/actions/runs/37921486739/job/113790208649)\nresults. The earlier local Fory checks were agent-run. Successful\nindependent Aster testing provides additional downstream evidence.\n- performance_verification: recorded above, including allocation costs\nand cold-start uncertainty.\n- provenance_license_confirmation: contributor confirmed\nApache-2.0-compatible licensing and provenance; no incompatible\nthird-party code introduced.\n\n### AI Contribution Checklist\n\n- [x] Substantial AI assistance is disclosed as **yes**, with scope and\naffected subsystem identified.\n- [x] Human line-by-line self-review completed before the final AI\nreview loop.\n- [x] Two fresh reviewers checked the current diff: one Fory-guided and\none independent general reviewer in a separate clean context.\n- [x] Both reviewers reported no further actionable comments; final\nresults identify the reviewed commit and are linked above.\n- [x] Human verification completed: contributor personally reviewed the\nthree passing upstream CI jobs linked above, with commands and outcomes\navailable in their logs.\n- [x] Regression tests cover the changed generated-code behavior; no\nshared protocol or public API change requires a specification update.\n- [x] Compatibility and performance evidence is included, with\nallocation costs and cold-start uncertainty stated.\n- [x] Contributor confirmed licensing and provenance compliance.\n\nThe Why section is contributor-authored; implementation, tests and\nremaining technical text were AI-assisted. The contributor completed\nhuman review and remains responsible for explaining and defending the\nchange. Further design/tradeoff discussion and review responses will be\ncontributor-authored."
    },
    {
      "commit": "d7ebfa7878b188d9e88216137363399ab5afbe36",
      "tree": "bd34304a1e06b2be8a28841b071b435304f0269a",
      "parents": [
        "3bd6ce229c59322dec3d8809502eb9807b147d0e"
      ],
      "author": {
        "name": "Swatantra Yadav",
        "email": "112210438+Swatantra-66@users.noreply.github.com",
        "time": "Sat Oct 10 08:02:47 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 08:02:47 2026 +0530"
      },
      "message": "feat(go): Enforce registration freeze after first root serialize/deserialize operation (#4161)\n\n## Why?\n\nIn Go, `Fory` previously allowed registering structs, enums, unions, and\nextensions after root serialization or deserialization had already\nbegun. This violated Fory\u0027s registration lifecycle design invariant,\ninvalidated precomputed type descriptors and resolver state, and\nintroduced subtle race conditions in shared/concurrent usage.\n\n## What does this PR do?\n\nEnforces permanent registration freeze on `Fory` instances upon the\nfirst root serialize or deserialize operation:\n\n1. **Export Sentinel Error**:\n- Defines `var ErrRegistrationFrozen \u003d errors.New(\"fory: registration is\nfrozen after serialization or deserialization has started\")`.\n2. **State \u0026 Methods**:\n- Keeps `frozen bool` state in `TypeResolver`. `Fory.Freeze()` and\n`Fory.IsFrozen()` delegate to the resolver so both registration paths\nshare the same permanent freeze.\n3. **Registration Guards**:\n- Guards all 8 public registration methods (`RegisterStruct`,\n`RegisterUnion`, `RegisterEnum`, `RegisterExtension`, and their `ByName`\nvariants) in `Fory` and `TypeResolver` to reject post-freeze calls\nimmediately before any reflection or map mutation occurs.\n4. **Root Operation Hooks**:\n- Automatically triggers `Freeze()` at the entry points of all root\nserialization and deserialization APIs (`Serialize`, `SerializeTo`,\n`Marshal`, `SerializeWithCallback`, `Serialize[T]`, `Deserialize`,\n`DeserializeFrom`, `Unmarshal`, `DeserializeWithCallbackBuffers`,\n`Deserialize[T]`, `DeserializeFromStream`, and `DeserializeFromReader`).\n5. **ThreadSafe Wrapper**:\n- Standardizes `threadsafe.Fory` to return `fory.ErrRegistrationFrozen`.\n6. **Tests**:\n- Adds comprehensive unit tests (`TestRegistrationFreeze`,\n`TestIssue4118Reproducer`, and\n`TestIssue4118FailedRootOperationFreezes`) verifying:\n     - Pre-operation registrations succeed.\n- All 8 registration methods return `ErrRegistrationFrozen` after root\nserialize or deserialize operations.\n- Failed serialize/deserialize attempts still permanently freeze\nregistration.\n- Rejected late registrations leave internal resolver maps and type\ntables completely unmutated.\n     - Generic and streaming APIs properly trigger freeze.\n\n## Related issues\n\nCloses #4118\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `no`\n\n## Does this PR introduce any user-facing change?\n\n- [x] Does this PR introduce any public API change? Exports\n`ErrRegistrationFrozen` and methods `Freeze()`, `IsFrozen()`.\n- [ ] Does this PR introduce any binary protocol compatibility change?\nNo.\n\n## Benchmark\n\nAll existing Go tests and benchmarks run cleanly without regressions.\n\n---------\n\nSigned-off-by: Swatantra Yadav \u003cmaverickswatantra@gmail.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "3bd6ce229c59322dec3d8809502eb9807b147d0e",
      "tree": "12163330421751912a6ed30fb1b438488737c463",
      "parents": [
        "5ea3e10057a921aa5bfecea14f4553915429ee2f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 01:33:47 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 01:33:47 2026 +0800"
      },
      "message": "ci: Bump handlebars from 4.7.9 to 4.7.10 in /javascript (#4160)\n\nBumps [handlebars](https://github.com/handlebars-lang/handlebars.js)\nfrom 4.7.9 to 4.7.10.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/releases\"\u003ehandlebars\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.7.10\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003esecurity: Sanitize the source map URL when minifying - f37c599\u003c/li\u003e\n\u003cli\u003esecurity: Iterate lazily in #each and strip whitespace in linear\ntime - 812c226\u003c/li\u003e\n\u003cli\u003esecurity: Escape \u003ccode\u003e\u0026lt;!--\u003c/code\u003e and \u003ccode\u003e\u0026lt;script\u003c/code\u003e in\nprecompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7\u003c/li\u003e\n\u003cli\u003esecurity: Don\u0027t trust special properties on context data - ceec388\nGHSA-p8wg-vrv2-v86f\u003c/li\u003e\n\u003cli\u003esecurity: Only compile partials that are template strings -\nc28ee7a\u003c/li\u003e\n\u003cli\u003esecurity: Only dispatch known node types in the Compiler and Visitor\n- 7d501a5\u003c/li\u003e\n\u003cli\u003esecurity: Validate AST values in the compiler instead of the parser\n- 703fdcc GHSA-8r5x-fm3f-whwj\u003c/li\u003e\n\u003cli\u003eClarify that --root does not restrict filesystem access -\n0fcf25c\u003c/li\u003e\n\u003cli\u003eBump minimist to ^1.2.8 - ea8ed82\u003c/li\u003e\n\u003cli\u003eFix Ruby component publishing documentation - d069c1c\u003c/li\u003e\n\u003cli\u003eFix Composer component definition - 6714e07\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eCompatibility notes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e{{#each}}\u003c/code\u003e iterates iterables such as \u003ccode\u003eMap\u003c/code\u003e,\n\u003ccode\u003eSet\u003c/code\u003e and generators lazily, like \u003ccode\u003efor...of\u003c/code\u003e,\ninstead of\ncopying them into an array first. Values added to the iterable while the\nblock renders are now visited too.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10\"\u003eCommits\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md\"\u003ehandlebars\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.7.10 - October 5th, 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003esecurity: Sanitize the source map URL when minifying - f37c599\u003c/li\u003e\n\u003cli\u003esecurity: Iterate lazily in #each and strip whitespace in linear\ntime - 812c226\u003c/li\u003e\n\u003cli\u003esecurity: Escape \u003ccode\u003e\u0026lt;!--\u003c/code\u003e and \u003ccode\u003e\u0026lt;script\u003c/code\u003e in\nprecompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7\u003c/li\u003e\n\u003cli\u003esecurity: Don\u0027t trust special properties on context data - ceec388\nGHSA-p8wg-vrv2-v86f\u003c/li\u003e\n\u003cli\u003esecurity: Only compile partials that are template strings -\nc28ee7a\u003c/li\u003e\n\u003cli\u003esecurity: Only dispatch known node types in the Compiler and Visitor\n- 7d501a5\u003c/li\u003e\n\u003cli\u003esecurity: Validate AST values in the compiler instead of the parser\n- 703fdcc GHSA-8r5x-fm3f-whwj\u003c/li\u003e\n\u003cli\u003eClarify that --root does not restrict filesystem access -\n0fcf25c\u003c/li\u003e\n\u003cli\u003eBump minimist to ^1.2.8 - ea8ed82\u003c/li\u003e\n\u003cli\u003eFix Ruby component publishing documentation - d069c1c\u003c/li\u003e\n\u003cli\u003eFix Composer component definition - 6714e07\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eCompatibility notes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e{{#each}}\u003c/code\u003e iterates iterables such as \u003ccode\u003eMap\u003c/code\u003e,\n\u003ccode\u003eSet\u003c/code\u003e and generators lazily, like \u003ccode\u003efor...of\u003c/code\u003e,\ninstead of\ncopying them into an array first. Values added to the iterable while the\nblock renders are now visited too.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10\"\u003eCommits\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/45ce15255e0f430ac6d19742b18e316b7539264e\"\u003e\u003ccode\u003e45ce152\u003c/code\u003e\u003c/a\u003e\nv4.7.10\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/e47b2365d5656ab5689ae226aef90a485a90c5d8\"\u003e\u003ccode\u003ee47b236\u003c/code\u003e\u003c/a\u003e\nUpdate release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/f37c599de9187715eb1e9afedcb2d80c175487a0\"\u003e\u003ccode\u003ef37c599\u003c/code\u003e\u003c/a\u003e\nSanitize the source map URL when minifying\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/812c2260cb8794ef4ab63a7f1d946431112560ca\"\u003e\u003ccode\u003e812c226\u003c/code\u003e\u003c/a\u003e\nIterate lazily in #each and strip whitespace in linear time\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725\"\u003e\u003ccode\u003e609d1b1\u003c/code\u003e\u003c/a\u003e\nEscape \u003ccode\u003e\u0026lt;!--\u003c/code\u003e and \u003ccode\u003e\u0026lt;script\u003c/code\u003e in precompiled\noutput\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa\"\u003e\u003ccode\u003eceec388\u003c/code\u003e\u003c/a\u003e\nDon\u0027t trust special properties on context data\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/c28ee7adb312308e0fe26f4d435a481be5e1ff98\"\u003e\u003ccode\u003ec28ee7a\u003c/code\u003e\u003c/a\u003e\nOnly compile partials that are template strings\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/7d501a5af2ac3aa9ac788a8889dbe419849e46f1\"\u003e\u003ccode\u003e7d501a5\u003c/code\u003e\u003c/a\u003e\nOnly dispatch known node types in the Compiler and Visitor\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2\"\u003e\u003ccode\u003e703fdcc\u003c/code\u003e\u003c/a\u003e\nValidate AST values in the compiler instead of the parser\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/commit/0fcf25c63038b43e78e17adbf029cf073e80554d\"\u003e\u003ccode\u003e0fcf25c\u003c/code\u003e\u003c/a\u003e\nClarify that --root does not restrict filesystem access\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dhandlebars\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d4.7.9\u0026new-version\u003d4.7.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "5ea3e10057a921aa5bfecea14f4553915429ee2f",
      "tree": "c99556c579dfb62e90ec0ee8766ec62b1af3bde7",
      "parents": [
        "24579dceb0f9cd58271913ff87299e8ef1ce7480"
      ],
      "author": {
        "name": "Ricardo Romero",
        "email": "ricardoromebeni@gmail.com",
        "time": "Fri Oct 09 16:45:02 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 20:15:02 2026 +0530"
      },
      "message": "fix(java): ignore JSON processor artifacts in native image (#4146)\n\nFixes #4145\n\nFory JSON Native Image builds now ignore Java annotation-processor\ncodecs and subtype tables, including artifacts packaged in dependencies.\nThe Native Image Feature owns model discovery and code generation at\nbuild time; ordinary JVM and Android processor behavior is unchanged.\n\nThe native registry retains only classes generated by the hosted\nFeature. The existing GraalVM harness now includes real\nprocessor-generated record, Mixin and sealed-subtype artifacts,\nasserting that they are present during the build but excluded from the\nnative image. Those models are exercised with generated and interpreted\nJSON configurations in the native executable.\n\nValidation on GraalVM 25.0.4:\n\n- Fory JSON: 1,283 tests passed.\n- `JsonTypeProcessorTest`: 74 tests passed.\n- JPMS (`-Pnative-module`) and classpath (`-Pnative`) native-image\nbuilds and both executables passed.\n- JSON Spotless/Checkstyle and integration-harness Spotless passed.\n\nThe harness compiles with `--release 17` and declares both supported\nNative Image SDK module names. GraalVM 17.0.12 JSON and full `Main` JPMS\nbuilds and executables passed; the full `Main` JPMS build and executable\nalso passed on GraalVM 25.0.4.\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "24579dceb0f9cd58271913ff87299e8ef1ce7480",
      "tree": "7cd001aa351acd8418a5e0dee1f4b2eadd6d9d8e",
      "parents": [
        "670e7a1d577f3a2b1a2dbd69f264adc1d39309a6"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Fri Oct 09 19:26:46 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 16:56:46 2026 +0530"
      },
      "message": "refactor(python): remove unused codegen module (#4150)\n\n## Why?\n\n`pyfory.codegen` is no longer used by the Python runtime. Its\nattrs-derived `_generate_filename` helper was identified during the\n1.7.7 RC3 vote as lacking the corresponding attribution in the source\narchive.\n\n## What does this PR do?\n\nRemove the unused `codegen.py` module, its dedicated `test_codegen.py`\ntests, and the `CompileError` exception used only by that module.\n\n## Validation\n\n- Repository-wide tracked-file search found no remaining imports or\nconsumers of the removed module or exception.\n- Fresh editable installation and native extension build passed with\nCPython 3.12.12.\n- Existing basic serializer and Struct tests passed in both Python and\nCython modes: 3 cases per mode, 6 total.\n- Ruff formatting and lint checks passed for `error.py`; `git diff\n--check` passed."
    },
    {
      "commit": "670e7a1d577f3a2b1a2dbd69f264adc1d39309a6",
      "tree": "8d8a4fb7646520b038fafde7dfb0d01c08e32724",
      "parents": [
        "261dc92eabdc5c0fe08748a3ba476ae13f4e8bc9"
      ],
      "author": {
        "name": "Jason Cat",
        "email": "jasonbuildai@gmail.com",
        "time": "Fri Oct 09 19:24:04 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 09 16:54:04 2026 +0530"
      },
      "message": "fix(java): reject null keys in Fory JSON string-keyed maps (#4149)\n\n## Why?\n\nFory JSON rejects null map keys, and\n`JsonAnyPropertyTest.rejectInvalidOutputKeys` asserts that behavior. But\nwhen a value is declared as `Map\u003cString, V\u003e` with `V` a `String`,\n`Boolean`, or built-in number type, the string-keyed fast paths in\n`MapCodec` (`StringStringMapCodec`, `StringBooleanMapCodec`,\n`StringNumberMapCodec`) write the entry key with no null check. A null\nkey is handed straight to `StringJsonWriter.writeString` /\n`Utf8JsonWriter.writeString` -\u003e `PlatformStringUtils.getStringValue`,\nwhich reads the value through `Unsafe.getReference(null, ...)`, so the\nJVM aborts with `EXCEPTION_ACCESS_VIOLATION` (reading address `0x14`)\ninstead of raising the documented `ForyJsonException`. An accidental or\nattacker-controlled null key therefore kills the process instead of\nreturning an error.\n\nFixes #4148.\n\n## What does this PR do?\n\nRoutes the three string-keyed fast-path `writeMap` bodies through the\nexisting `writeKey(writer, key, STRING_KEY_CODEC)` helper, which is\nalready used by every other map key path (object values, non-string\nkeys, dynamic writes). `writeKey` throws `ForyJsonException(\"JSON map\nkey cannot be null\")` for a null key and otherwise writes the member\nname exactly as before, so non-null behavior is unchanged.\n\n-\n`java/fory-json/src/main/java/org/apache/fory/json/codec/MapCodec.java`:\n3 lines changed (one per codec).\n-\n`java/fory-json/src/test/java/org/apache/fory/json/JsonContainerTest.java`:\nadds `rejectNullStringMapKeys`, covering `String`, `Boolean`, and `Long`\nvalues and both `toJson` and `toJsonBytes`.\n\nNo public API, wire-format, or binary-compatibility change. The fix\nbrings the string-keyed paths in line with the already-rejecting paths\nand the documented behavior in `docs/json/object-mapping.md`.\n\n## Related issues\n\nFixes #4148\n\n## Evidence\n\nStandalone repro (`ZzNullKeyProbe`, fory-json on the classpath), before\nvs after the change.\n\nBefore -- the string-keyed variants (`string-string`, `string-int`,\n`string-bool`, `string-double`, `string-bean-value`, `utf8-string-key`)\nabort the JVM (exit code 1):\n\n```text\n# A fatal error has been detected by the Java Runtime Environment:\n#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc\u003d..., pid\u003d38184, tid\u003d...\n# Problematic frame:\n# j  org.apache.fory.json.writer.StringJsonWriter.writeString(Ljava/lang/String;)V+78\n# j  org.apache.fory.json.codec.MapCodec$StringStringMapCodec.writeMap(...)\nsiginfo: EXCEPTION_ACCESS_VIOLATION (0xc0000005), reading address 0x0000000000000014\n```\n\n(`object-value`, `int-key`, and `dynamic` already threw\n`ForyJsonException` before the change.)\n\nAfter -- all nine variants exit 0:\n\n```text\nTHREW org.apache.fory.json.ForyJsonException: JSON map key cannot be null\n```\n\nRegression test, with the fix reverted vs applied:\n\n```text\n$ mvn -pl fory-json test -Dtest\u003dJsonContainerTest#rejectNullStringMapKeys\n# before (fix reverted):\n[ERROR] Tests run: 0, Failures: 0, Errors: 0, Skipped: 0\n[INFO] BUILD FAILURE\n[ERROR] The forked VM terminated without properly saying goodbye. VM crash or System.exit called?\n[ERROR] Crashed tests:\n[ERROR] org.apache.fory.json.JsonContainerTest\n# after:\n[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.475 s -- in org.apache.fory.json.JsonContainerTest\n[INFO] BUILD SUCCESS\n```\n\nProject checks (from `java/`, after the fix):\n\n```text\n$ mvn -pl fory-json test\n[INFO] Tests run: 1286, Failures: 0, Errors: 0, Skipped: 0\n[INFO] BUILD SUCCESS\n\n$ mvn -T16 spotless:check\n[INFO] BUILD SUCCESS\n\n$ mvn -T16 checkstyle:check\n[INFO] BUILD SUCCESS\n```\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] If `yes`, I included the standardized `AI Usage Disclosure` block\nbelow.\n- [x] If `yes`, I can explain and defend all important changes without\nAI help.\n- [x] If `yes`, I reviewed AI-assisted code changes line by line before\nsubmission.\n- [x] If `yes`, I completed line-by-line self-review first and fixed\nissues before requesting AI review.\n- [x] If `yes`, I ran two fresh AI review agents on the current PR diff\nor current HEAD after the latest code changes: one Fory-guided reviewer\nusing `AGENTS.md` and `.agents/ci-and-pr.md`, and one independent\ngeneral reviewer in a separate clean-context review session that was not\npointed to `.agents/ci-and-pr.md` or any copied Fory-specific review\nchecklist.\n- [x] If `yes`, I addressed all AI review comments and repeated the\nreview loop until both AI reviewers reported no further actionable\ncomments.\n- [x] If `yes`, I attached persisted links of the final clean AI review\nresults from both fresh reviewers on the current PR diff or current HEAD\nafter the latest code changes in this PR body.\n- [x] If `yes`, I ran adequate human verification and recorded evidence\n(checks run locally, pass/fail summary, and confirmation I reviewed\nresults).\n- [x] If `yes`, I added/updated tests and specs where required.\n- [x] If `yes`, I validated protocol/performance impacts with evidence\nwhen applicable (N/A: no protocol or performance-sensitive path\nchanged).\n- [x] If `yes`, I verified licensing and provenance compliance.\n\n## AI Usage Disclosure\n\n```text\nAI Usage Disclosure\n- substantial_ai_assistance: yes\n- scope: design drafting, code drafting, tests\n- affected_files_or_subsystems: java/fory-json (org.apache.fory.json.codec.MapCodec, org.apache.fory.json.JsonContainerTest)\n- ai_review: line-by-line self-review completed; ran two fresh reviewers on the current diff (HEAD b76d96a87bf8c80748be6196244af11a5f9df01c) -- a Fory-guided reviewer following AGENTS.md and .agents/ci-and-pr.md, and an independent general reviewer in a clean-context session. No actionable comments remained; both reviewers reported no further comments. No code changed after this review round.\n- ai_review_artifacts: https://gist.github.com/JasonBuildAI/9ebe2ccef8c31d5c53db2c863396abe3 (final clean results from both fresh reviewers on the current diff: review_fory_guided.md and review_independent.md)\n- human_verification: ran locally from java/ -- `mvn -pl fory-json test` (Tests run: 1286, Failures: 0, Errors: 0, Skipped: 0, BUILD SUCCESS), targeted `mvn -pl fory-json test -Dtest\u003dJsonContainerTest#rejectNullStringMapKeys` (2 pass, BUILD SUCCESS), `mvn -T16 spotless:check` (BUILD SUCCESS), `mvn -T16 checkstyle:check` (BUILD SUCCESS); also reverted the fix to confirm the standalone repro and the regression test crash the JVM before the change. Contributor reviewed all results.\n- performance_verification: N/A (no serialization/deserialization hot path, allocation, codegen, or buffer logic changed; only a null guard on an error path)\n- provenance_license_confirmation: Apache-2.0-compatible provenance confirmed; no incompatible third-party code introduced; change only reuses existing in-tree helpers\n```\n\n## Does this PR introduce any user-facing change?\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\nN/A -- no performance-sensitive path changed."
    },
    {
      "commit": "261dc92eabdc5c0fe08748a3ba476ae13f4e8bc9",
      "tree": "96e50fec2cc7684d75e92abaaebc0d35923cb152",
      "parents": [
        "b12ee96105082009a4ab8066f8ec27a3f528de72"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Thu Oct 08 15:46:25 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 13:16:25 2026 +0530"
      },
      "message": "fix(java): validate compatible values against local field types (#4144)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "b12ee96105082009a4ab8066f8ec27a3f528de72",
      "tree": "cb3aee6f595bfbdeb22e61dca13ad5a20a303b73",
      "parents": [
        "5074efcc9fc5e6f45004789a5c71c01b99475275"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Thu Oct 08 15:31:19 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 13:01:19 2026 +0530"
      },
      "message": "fix(java): make Java and Kotlin release archives reproducible (#4143)\n\n## Summary\n\nFixes #4138.\n\n- Assemble multi-release classes and sources before Maven writes the\narchives,\n  removing the Ant JAR updates that replaced reproducible timestamps.\n- Preserve core\u0027s post-shading module-package refresh without rewriting\na class\nentry on the JDK 25 release toolchain; retain the required input on\nolder JDKs.\n- Upgrade the source plugin to 3.3.1 and package Dokka output with the\nexisting\nMaven JAR plugin so all release archives honor\n`project.build.outputTimestamp`.\n- Pass an empty javac source path as `--source-path\u003d` so Ant response\nfiles cannot\n  consume the first source filename as the option value.\n\n## Validation\n\n- Reproduced the original long-dependency-path build failure, then\npassed the\n  same clean JDK 25 release build after the fix.\n- Two clean Java/Kotlin release builds produced 29/29 byte-identical\narchives\n(27 JARs and two source-release ZIPs), while varying timezone, username,\nsource mtimes, dependency path, SOURCE_DATE_EPOCH, and ISO versus\nequivalent\n  epoch-second output timestamps.\n- Existing Java/Kotlin release-artifact and multi-release archive checks\npassed.\n- Verified all Java class/source entries remain present and ordinary\nclass bytes\n  are unchanged; core module semantics remain unchanged after shading.\n- JDK 11 non-release core packaging passed.\n- JDK 25 full Java reactor `clean install` and JPMS tests passed. Kotlin\ntests,\nJava/Kotlin Spotless, and Java Checkstyle passed. Optional local xlang\nsuites\nretain their existing environment-gated skips; remote CI covers those\npeers."
    },
    {
      "commit": "5074efcc9fc5e6f45004789a5c71c01b99475275",
      "tree": "d522ba0167bef034aa49e69e939a65fbf1d9656c",
      "parents": [
        "b98471c0d7deba1010f8b01040c810bd5007ff10"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Thu Oct 08 15:00:50 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 12:30:50 2026 +0530"
      },
      "message": "fix(java): preserve JSON object field semantics (#4142)\n\n## Summary\n\n- Restore eligible final fields when reading JSON and select the\nsubclass field when it hides a superclass field.\n- Write the complete runtime subclass state through concrete declared\nobject types; reads continue to use the declared type unless subtype\nmetadata is configured.\n- Consult registered `JsonCodecFactory` implementations for declared\n`Object` values inside containers.\n- Document the resulting object mapping and factory behavior.\n\nFixes #4136\nFixes #4137\nFixes #4139\nFixes #4140\n\n## Testing\n\n- `ENABLE_FORY_DEBUG_OUTPUT\u003d1 mvn -T16 -pl fory-json -am install\n-DskipTests`\n- `ENABLE_FORY_DEBUG_OUTPUT\u003d1 mvn -pl fory-json test` (1,284 tests\npassed)\n- `mvn -pl fory-json spotless:apply spotless:check checkstyle:check`\n- `prettier --write docs/json/object-mapping.md\ndocs/json/getting-started.md`"
    },
    {
      "commit": "b98471c0d7deba1010f8b01040c810bd5007ff10",
      "tree": "8c25fa81609934d3d195e223ffb2d57ef447e425",
      "parents": [
        "dcf8d24f2c0c2a502d405ef0fb9d49b973dc9137"
      ],
      "author": {
        "name": "PJ Fanning",
        "email": "pjfanning@users.noreply.github.com",
        "time": "Wed Oct 07 09:46:48 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 07 14:16:48 2026 +0530"
      },
      "message": "chore: Add NOTICE file to benchmarks dir (#4135)\n\nfollow up to #4134 \n\nApache License declarations typically have NOTICE files along side them."
    },
    {
      "commit": "dcf8d24f2c0c2a502d405ef0fb9d49b973dc9137",
      "tree": "6b0ea39c6af9dfd1bca5c8d80ddc6720ea6a021a",
      "parents": [
        "bb2c1c9a0e2cf5b4f8c0152325814c357d9c7105"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Oct 07 11:43:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 07 09:13:56 2026 +0530"
      },
      "message": "fix(release): archive RC tags without temporary license commits (#4134)\n\nSource releases currently rewrite `LICENSE`, create a temporary commit,\narchive it, and reset the branch. The resulting tarball contains an\nunpublished commit ID and cannot be reproduced directly from the RC tag.\n\nMove benchmark-only attribution into `benchmarks/LICENSE`, retaining the\ncore Kryo attribution in the root license. Build source artifacts\ndirectly from an explicit `--rc-tag`, without modifying tracked files or\nGit refs, and update the release instructions to verify the embedded\ncommit ID. This follows [PJ Fanning\u0027s suggestion in the 1.7.7 RC1\nvote](https://lists.apache.org/thread/zb2yzboxf28lz7wm0zlvscqvn0pntp62).\n\nValidation:\n\n- Ran the actual `ci/release.py build -v 0.0.0 --rc-tag ...` command for\nlightweight and annotated tags in a local fixture repository, with HEAD\nadvanced beyond the tags and an ephemeral GPG test key.\n- Both archives match direct `git archive` output byte for byte, contain\nthe tagged commit ID and unchanged root license, exclude benchmarks, and\npass signature/SHA-512 verification. Branch, HEAD, refs, reflogs, and\nworking tree remain unchanged.\n- Verified all eight benchmark attribution paths were preserved, with\nApache/Kryo license texts and core attribution intact.\n- Ruff, Prettier, markdownlint, and `git diff --check` pass."
    },
    {
      "commit": "bb2c1c9a0e2cf5b4f8c0152325814c357d9c7105",
      "tree": "364780565261b4e052304f69f1c5c7eda448761e",
      "parents": [
        "f53dd7f15976be4673fa61cfa2ac70f8939f03ae"
      ],
      "author": {
        "name": "Hkwaynewing",
        "email": "Ringwenwen@live.cn",
        "time": "Wed Oct 07 12:56:52 2026 +1100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 07 07:26:52 2026 +0530"
      },
      "message": "fix(java): advance readerIndex in continueReadBinarySize (#4133)\n\n## Why?\nThe 3/4-byte varint length-prefix fast path of readBinarySize()\ndelegates to continueReadBinarySize(), which decoded the size but never\nassigned readerIndex, unlike the \u003c\u003d2-byte path. readBytesAndSize() (and\nreadStringAndSize / *WithSize primitive readers) then copied the body\nfrom the stale index, i.e. starting at the first prefix byte: payloads\nwith big enough length came back shifted by the prefix width, silently\ncorrupted, or failed downstream with \"reserved header bitmap flags\"\nerrors.\n\n## What does this PR do?\n\nFix both the base and the java25 MemoryBuffer by assigning readerIndex \u003d\nreadIdx in continueReadBinarySize, matching continueReadVarUInt32. Add a\nregression test covering 3-byte and 4-byte prefixes plus a trailing read\nto verify index alignment.\n\nThe Android path (MemoryOps.readBinarySize -\u003e readVarUInt32) already\nadvances readerIndex correctly and needed no change.\n\n## Related issues\n\nNo related issue found\n\nCo-authored-by: Wayne Wen \u003cwwen@seek.com.au\u003e"
    },
    {
      "commit": "f53dd7f15976be4673fa61cfa2ac70f8939f03ae",
      "tree": "b2a8677fd90d1057569a668bfdef6fddbd13596e",
      "parents": [
        "3bc13131fac38065cc359664758fa4f8f74b4d31"
      ],
      "author": {
        "name": "Pavel Ptashyts",
        "email": "49400901+pavel-ptashyts@users.noreply.github.com",
        "time": "Tue Oct 06 17:46:06 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 23:46:06 2026 +0800"
      },
      "message": "perf(java): copy plain runs after the first escape when writing JSON strings (#4122)\n\n## Why?\n\nThis is the writing side of #4055 / #4058. Once a string being written\ncontains its first character that needs escaping (a quote, a backslash,\na control character, or non-ASCII text with `escapeNonAscii`), both JSON\nwriters write the rest of it one character at a time through\n`writeEscapedChar` - a switch, a capacity check and one store per\ncharacter - and never return to a bulk copy. The cost of a string\ntherefore follows the distance from that character to its end, not the\nnumber of characters to escape: one quote near the front of a 20 KB\nstring makes it 13 times slower to write than with no quote at all. In\n`Utf8JsonWriter` a compact latin1 string longer than the fixed-size fast\npaths is also rescanned with `charAt` up to that character, so even a\nquote at the very end costs 5 times. Details and measurements in #4121.\n\n## What does this PR do?\n\n- `Utf8JsonWriter`: a compact latin1 `String` that the fast paths reject\nnow goes from `writeStringChars` to `writeLatin1StringEscaped`, which\ncopies each plain run a word at a time with the existing\n`isJsonAsciiWord` predicate, writes only the byte that stopped it\nthrough `writeEscapedChar`, and resumes. The character tails\n(`writeStringSlow` for `String` and `CharSequence`) copy the plain ASCII\nrun up to the next stop with one capacity check per run, then handle the\nstop character exactly as before.\n- `StringJsonWriter`: the same in all four tails.\n`writeLatin1StringSlow` and `writeLatin1StringUtf16Slow` copy plain\nwords and resume the word copy after a byte above 0x7F, running the word\npredicate at most once per eight bytes. In `writeStringSlow` the run\nfollows the current output coder, because a character above 0xFF\nupgrades the output to UTF16 in the middle of a string; the UTF16 runs\n(`writeStringSlow`, `writeStringUtf16Slow`) clear `latin1Output` when\nthey copy such a character.\n- Every run copy reserves capacity for at most `RUN_CHUNK` (8192)\ncharacters at a time, the way `writeEscapedUtf16` already bounds its\nreservation, so `(length - i) \u003c\u003c 1` or `pos + (length - i)` cannot\noverflow for a huge string and skip `grow` before the word stores. A run\nthat ends at a chunk boundary rather than at a stop just continues. The\ncopy is inlined into each tail: a helper call per stop measurably slowed\nstrings with many escapes.\n- The hot `writeString(String)` methods and their fixed-size fast paths\nare untouched; all new code is in the cold paths, following the\nC2-layout notes in both classes. The output is byte-identical.\n- Tests in `JsonStringTest`:\n- `writeEscapeFollowedByOtherText` compares both writers with\n`JsonStringEscaper` (a character-at-a-time reference) for a stop\ncharacter (quote, backslash, newline, control character, latin1 above\n0x7F) followed by latin1 text, 0x7F/0x80, text outside latin1, a\nsurrogate pair and further escapes, with 0-20 characters before it and\n0-8 after it so stops land in every lane of a word, with and without\ntrailing text, for `String` and `CharSequence` input (each on a fresh\nwriter), utf8 output and LATIN1 and UTF16 string output, with and\nwithout `escapeNonAscii`. Accepting a quote inside the latin1 run, or\nignoring `escapeNonAscii` in the UTF16 run, makes it fail.\n- `writeRunsAcrossReservationChunks`: a quote, latin1 above 0x7F, text\noutside latin1 and a surrogate pair at 8192 +/- 9 characters after an\nescape, so they land on and around a chunk boundary.\n- `writeRejectsUnpairedSurrogateAfterAnEscape`: an unpaired high or low\nsurrogate after an escape, inside a long plain run and at the end, is\nstill rejected by both writers, with and without `escapeNonAscii`.\n- `writeEscapeThenWideTextAfterUtf16Reset`: a writer reset after a UTF16\nresult starts in UTF16 while assuming its output fits latin1; the run\ncopy must withdraw that assumption. Removing the `latin1Output` clear\nmakes it fail.\n- The old code was correct but slow, so these tests pin behaviour and\nalso pass on it.\n\n## Related issues\n\n- Fixes #4121\n- Writing counterpart of #4055 / #4058\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [x] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\nCompleted checklist from `AI_POLICY.md` section 9:\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] I included the standardized `AI Usage Disclosure` block below.\n- [x] I can explain and defend all important changes without AI help.\n- [x] I reviewed AI-assisted code changes line by line before\nsubmission.\n- [x] I completed line-by-line self-review first and fixed issues before\nrequesting AI review.\n- [x] I ran two fresh AI review agents on the current PR diff or current\nHEAD after the latest code changes: one Fory-guided reviewer using\n`AGENTS.md` and `.agents/ci-and-pr.md`, and one independent general\nreviewer in a separate clean-context review session that was not pointed\nto `.agents/ci-and-pr.md` or any copied Fory-specific review checklist.\n- [x] I addressed all AI review comments and repeated the review loop\nuntil both ai reviewers reported no further actionable comments.\n- [x] I attached equivalent persisted links of the final clean AI review\nresults from both fresh reviewers on the current PR head in this PR\nbody.\n- [x] I ran adequate human verification and recorded evidence (checks\nrun locally, pass/fail summary, and confirmation I reviewed results).\n- [x] I added/updated tests and specs where required.\n- [x] I validated protocol/performance impacts with evidence when\napplicable.\n- [x] I verified licensing and provenance compliance.\n\n```text\nAI Usage Disclosure\n- substantial_ai_assistance: yes\n- scope: investigation, code drafting, tests, benchmark harness, PR text\n- affected_files_or_subsystems: java/fory-json writers (Utf8JsonWriter, StringJsonWriter) and JsonStringTest\n- ai_review: line-by-line self-review of the AI-drafted change is pending by the contributor (see unchecked items above). Two-reviewer loop on fresh sessions for every round, six rounds: Fory-guided reviewer Codex gpt-6-astra (xhigh), independent general reviewer Claude Fable 5.1. Fixed from review: each input type written by a fresh writer in the test so a CharSequence reaches the mid-string LATIN1-to-UTF16 upgrade itself; 0x7F/0x80 tails and strings ending right after a stop; surrogate test with and without escapeNonAscii; the StringJsonWriter latin1 tails resume the word copy after a byte above 0x7F, run the word predicate at most once per eight bytes and document that they are only reached without non-ASCII escaping; a test for the latin1Output clear after a UTF16 reset; every run copy reserves at most RUN_CHUNK characters at a time so the capacity arithmetic cannot overflow for huge strings (found by the Fory-guided reviewer), with a chunk-boundary test; the run copies are inlined into each tail after a helper call per stop measurably slowed strings with many escapes. Kept by decision: hot writeString fast paths untouched; String and CharSequence overloads stay duplicated like the existing code; tests check behaviour against JsonStringEscaper rather than speed. Final round on the current head: both reviewers report no further actionable comments.\n- ai_review_artifacts: Fory-guided reviewer: https://github.com/apache/fory/pull/4122#issuecomment-5997450696 ; independent general reviewer: https://github.com/apache/fory/pull/4122#issuecomment-5997451342 (both on commit 72008b9e9a15f2f9fe1de2fdd3cf529a849056dd, the current head, final round, no further actionable comments)\n- human_verification: see \"Verification\" below\n- performance_verification: see \"Benchmark\" below\n- provenance_license_confirmation: all code written for this PR against the Apache Fory sources; no third-party code introduced\n```\n\n## Verification\n\nJDK 25.0.2, Windows 11 x86_64, from `java/`:\n\n- `mvn -pl fory-json -am install -DskipTests`: success\n- `mvn -pl fory-json test`: 1276 tests, 0 failures, 0 errors, 0 skipped\n- `JsonStringTest#writeEscapeFollowedByOtherText` with a quote accepted\ninside the latin1 run of `Utf8JsonWriter`, and with `escapeNonAscii`\nignored in the `StringJsonWriter` UTF16 run copy: fails, as intended\n- `JsonStringTest#writeEscapeThenWideTextAfterUtf16Reset` with the\n`latin1Output` clear removed from the UTF16 run copy: fails (`中` comes\nback as `-`), as intended\n- `mvn -pl fory-json spotless:check checkstyle:check`: success, 0\nCheckstyle violations\n\n## Does this PR introduce any user-facing change?\n\n- [x] Does this PR introduce any public API change? No.\n- [x] Does this PR introduce any binary protocol compatibility change?\nNo. The JSON output is byte-identical.\n\n## Benchmark\n\nStandalone harness from #4121 (not JMH): a bid whose `adm` field is a\n19998-character VAST XML string, pure ASCII, 612 quotes and 345\nnewlines, the first quote at character 15. Variants change only the\ncharacters that need escaping inside `adm`, keeping its length.\n`ForyJson.builder().build()`, best of 7 rounds of 5000 writes after\n30000 warm-up writes, one JVM per build, builds alternating three times\non an otherwise idle machine; JDK 25.0.2. Range over the three runs,\nmicroseconds per write:\n\n| variant | `toJsonBytes` main f85877f2 | `toJsonBytes` this PR |\n`toJson` main | `toJson` this PR |\n| --- | ---: | ---: | ---: | ---: |\n| nothing to escape | 3.6-3.8 | 3.6-3.7 | 3.4-3.5 | 3.4-3.5 |\n| one quote at the very end | 18.7-19.0 | 6.0-6.4 | 3.3-3.4 | 3.3-3.4 |\n| one quote at character 1 | 44.5-45.0 | 4.2-4.6 | 33.8-36.8 | 3.7-4.0 |\n| the real string | 44.3-45.0 | 9.9-10.4 | 36.5-40.7 | 14.6-15.8 |\n\nA bean of eight short strings, four of them with one escape each:\n286-291 ns -\u003e 181-191 ns (`toJsonBytes`), 255-272 ns -\u003e 231-235 ns\n(`toJson`). The output digest is identical between the builds in every\ncase. For reference, Jackson 3.1 `writeValueAsString` takes 12.5 us on\nthe string without escapes and 25.0 us on the real one.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "3bc13131fac38065cc359664758fa4f8f74b4d31",
      "tree": "c45ba8c5680a8fb1b7019e484b98198c96f53947",
      "parents": [
        "e60447705962a90ba79f1b9f628d70230cd1136a"
      ],
      "author": {
        "name": "PJ Fanning",
        "email": "pjfanning@users.noreply.github.com",
        "time": "Tue Oct 06 16:18:37 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 23:18:37 2026 +0800"
      },
      "message": "ci: check license headers in swift, dart, cython, idl, bazel, sbt and msbuild files (#4125)\n\n## Why?\n\nhawkeye has no comment-style mapping for several file types used in the\nrepo, so it lists them as \"unknown files\" and never checks their license\nheaders. Most of them already carry the ASF header, but nothing enforces\nit.\n\n## What does this PR do?\n\n- Adds hawkeye mappings in `licenserc.toml`:\n  - `DOUBLESLASH_STYLE`: `swift`, `fdl`, `idl`, `fbs`\n  - `SLASHSTAR_STYLE`: `dart`, `sbt`\n- `SCRIPT_STYLE`: `pyx`, `pxd`, `pxi`, `bzl`, `bazel`, `gyp`, plus\n`BUILD`, `WORKSPACE`, `.bazelrc`, `ForyConfig.cmake.in`,\n`BUILD.standalone` and `MODULE.bazel.example`\n  - `XML_STYLE`: `csproj`, `props`\n- Rewrites the headers of the 30 files that hawkeye then rejected, using\n`hawkeye format`. Their headers were in a different layout (`/**`\ninstead of `/*`, `//` in Dart, different line wrapping, single-spaced\nsentences) or missing. The wording is unchanged.\n- In `integration_tests/grpc_tests/swift/interop/Package.swift`, puts\nthe new header after `// swift-tools-version`, because SwiftPM requires\nthat line first. The root `Package.swift` is laid out the same way.\n- Excludes `bazel/cython_library.bzl`, which is derived from gRPC and\nlisted in LICENSE, plus two generated benchmark files: `models.g.dart`\nand `bench.pb.swift`.\n- Removes the stale `go/fory/tests/structs_fory_gen.go` exclude; that\nfile no longer exists.\n- Leaves `csharp/Fory.sln` unmapped, because Visual Studio requires its\nformat line first.\n\nVerification:\n- `korandoru/hawkeye:v6 check` on this branch: \"No missing header file\nhas been found\".\n- `xmllint --noout` passes on every changed `.csproj` and `.props` file.\n- `swift package tools-version` in the interop package still reports\n`5.9.0`.\n\n## Related issues\n\n- Related to #4124, which covers the remaining config files that could\ntake a header.\n\n## Does this PR introduce any user-facing change?\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Shawn Yang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "e60447705962a90ba79f1b9f628d70230cd1136a",
      "tree": "356c79154d49761037b2455b2dabe0d8c9dc8691",
      "parents": [
        "d64cc8e82f701999135e75f350168c4b9190218f"
      ],
      "author": {
        "name": "PJ Fanning",
        "email": "pjfanning@users.noreply.github.com",
        "time": "Tue Oct 06 15:35:58 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 22:35:58 2026 +0800"
      },
      "message": "fix(license): add missing third-party attributions and ship LICENSE/NOTICE in Python wheels (#4127)\n\n## Why?\n\nLICENSE is missing two third-party sources, and still ships a licence\nfile nothing refers to. All three were found while verifying the\n1.7.7-rc1 source release; see #4126. The Python wheels have a related\ngap: they ship with no LICENSE or NOTICE at all.\n\n## What does this PR do?\n\n- **Fluent Python (MIT).** `record_class_factory` in\n`python/pyfory/type_util.py` is derived from `record_factory` in\n[fluentpython/example-code](https://github.com/fluentpython/example-code/blob/a7861802390010fc322f7fdbabf441ba36ed56f3/21-class-metaprog/factories.py).\nThis PR:\n  - adds an entry under \"MIT licenses\" in LICENSE;\n  - adds the upstream MIT text as `licenses/LICENSE-fluentpython.txt`;\n- replaces the comment `# modified from \u0027fluent python\u0027` with the\nupstream link and copyright notice, matching the existing `dataslots`\nattribution in the same file.\n- **Apache Spark.** `ClassLoaderUtils.java` (`ParentClassLoader`,\n`ChildFirstURLClassLoader`) is derived from Spark. This PR adds it to\nthe spark entry in `LICENSE`, `java/LICENSE` and the fory-core jar\u0027s\n`META-INF/LICENSE`.\n- **Stale V8 licence.** This PR removes `licenses/LICENSE-v8.txt`. The\nvendored `v8-fast-api-calls.h` it covered, and its LICENSE entry, were\nremoved in #2137.\n- **Protobuf comment.** This PR rewords the comment on `CPP_KEYWORDS` in\n`compiler/fory_compiler/generators/cpp.py`. It said the list was \"Taken\nfrom kKeywordList … in protobuf\". It is a list of C++ keywords,\nalternative operator tokens and the `NULL`/`assert` macros, not protobuf\ncode.\n\n- **Python wheels have no LICENSE or NOTICE.** `python/pyproject.toml`\ndeclares `license \u003d {file \u003d \"LICENSE\"}`, but `python/LICENSE` doesn\u0027t\nexist and nothing in the build copies one in. setuptools only prints\n`File \u0027.../LICENSE\u0027 cannot be found` and carries on. As a result, every\npublished pyfory wheel ships with no LICENSE or NOTICE. I checked the\nmanylinux and macOS wheels for 1.7.6, 1.0.0 and 0.13.0 on PyPI. This PR\nadds `python/LICENSE` and `python/NOTICE`, following the existing\nper-package files (`java/LICENSE`, `go/fory/LICENSE`,\n`dart/packages/fory/LICENSE`). They contain the Apache-2.0 text\n(identical to the root LICENSE) plus the third-party code the wheel\nactually contains:\n\n  | Component | Licence | Where it ends up in the wheel |\n  |---|---|---|\n  | dataclasses | Apache-2.0 | `pyfory/type_util.py` (`dataslots`) |\n| Fluent Python example code | MIT (full text included) |\n`pyfory/type_util.py` (`record_class_factory`) |\n| abseil-cpp (`cpp/fory/thirdparty/flat_hash_map.h`) | Apache-2.0 |\n`serialization` extension |\n| smhasher (`cpp/fory/thirdparty/MurmurHash3.*`) | Public domain |\n`mmh3` and `serialization` extensions |\n\nI worked out the list from the Bazel targets for `//:cp_fory_so`. They\nlink only Fory\u0027s own C++ plus those two vendored third-party files;\nthere are no external C++ libraries. No build change is needed:\nsetuptools adds `LICENSE*` and `NOTICE*` from the project directory to\nthe wheel\u0027s `dist-info`. I checked this by running\n`BAZEL_BUILD_EXT\u003dFalse python setup.py bdist_wheel` with setuptools\n84.0.0 and 70.3.0 (the Python 3.8 range). Both wheels contain LICENSE\nand NOTICE, and METADATA lists them as `License-File` entries.\n\nThere is no code change apart from comments. `ruff check` and `ruff\nformat --check` give the same results on the changed Python files as on\n`main`.\n\n## Related issues\n\n- Fixes #4126\n\n## Does this PR introduce any user-facing change?\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "d64cc8e82f701999135e75f350168c4b9190218f",
      "tree": "e0b719786e9233dca5b9398deb7300420333506f",
      "parents": [
        "f85877f2a9371328ec581653a648e365b7a349d1"
      ],
      "author": {
        "name": "PJ Fanning",
        "email": "pjfanning@users.noreply.github.com",
        "time": "Tue Oct 06 15:34:29 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 22:34:29 2026 +0800"
      },
      "message": "fix(license): list zmij in fory-json jar LICENSE; per-module Scala NOTICE (#4130)\n\n## Why?\n\nTwo convenience-binary licensing problems found in the 1.7.7-rc1 Nexus\nstaging jars. See #4129 for the full analysis.\n\n## What does this PR do?\n\n- **fory-json jar LICENSE.** `FloatingDecimal` is adapted from\n[zmij](https://github.com/vitaut/zmij) (MIT). The jar already ships\n`META-INF/licenses/LICENSE-zmij.txt`, but\n`java/fory-json/src/main/resources/META-INF/LICENSE` (which becomes the\njar\u0027s `META-INF/LICENSE`) had no MIT section. This PR adds the zmij\nentry, in the same format the fory-core jar LICENSE uses for Kryo.\n- **Scala jar NOTICE.** `scala/build.sbt` set `apacheSonatypeNoticeFile`\nto the root source NOTICE for every module, so the `fory-scala` and\n`fory-json-scala` jars listed Spark, Commons IO, Commons Lang,\ndataclasses and gRPC, none of which they contain. This PR:\n- adds `scala/fory-scala/NOTICE` and `scala/fory-json-scala/NOTICE`,\nmatching the per-module LICENSE files that are already there;\n  - points each module\u0027s `apacheSonatypeNoticeFile` at its own NOTICE.\n\n`fory-json-scala`\u0027s only third-party-derived code is based on\njackson-module-scala, which has no NOTICE file, so the plain Apache Fory\nnotice is correct for both modules. The unpublished root aggregate\nproject keeps its own setting.\n\nVerification:\n- The staged 1.7.7-rc1 jars use exactly these files:\n- the `fory-json-1.7.7.jar` `META-INF/LICENSE` is byte-identical to the\nresource at `v1.7.7-rc1`;\n- the `fory-scala_3-1.7.7.jar` `META-INF/NOTICE` is byte-identical to\nthe root `NOTICE`.\n- `sbt \"show fory-scala/apacheSonatypeNoticeFile\" \"show\nfory-json-scala/apacheSonatypeNoticeFile\"` resolves to the new\nper-module files.\n- `sbt fory-scala/Compile/packageBin fory-json-scala/Compile/packageBin\nfory-scala/Compile/packageSrc` succeeds, and the built jars contain the\nnew module NOTICE.\n\n## Related issues\n\n- Fixes #4129\n\n## Does this PR introduce any user-facing change?\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "f85877f2a9371328ec581653a648e365b7a349d1",
      "tree": "a206395eb058239c703a23a945f40af62e05bac8",
      "parents": [
        "7234c41bec3f188aa9b7bbb2aa0cebad6c97ee6b"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Mon Oct 05 11:47:01 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 11:47:01 2026 +0530"
      },
      "message": "fix(compiler): preserve union case names on unknown-carrier collisions (#4106)\n\n## What does this PR do?\n\nAn IDL union case named `unknown` collides with the automatically\ngenerated unknown-case carrier in C#, Kotlin, Scala, Rust, and Swift.\nRenaming the schema case to `UnknownValue` also collides when the schema\ndeclares `unknown_value`.\n\nPreserve schema case names and rename only the generated carrier: use\n`Unknown_` on collision in C#, Kotlin, Scala, and Rust, or `unknown_` in\nSwift. If the alternate name is also occupied, fail generation. The\nsource generators identify the carrier by its annotation or attribute,\npreserving its structural and uniqueness requirements. Case IDs,\ndefaults, and wire encoding remain unchanged.\n\n## Validation\n\n- Compiler: 536 tests passed, including generated-name checks and\ndouble-collision rejection.\n- Actual IDL-generated unions in all five languages round-trip both\nschema cases and the renamed unknown carrier, preserve its case ID and\nvalue, and reserialize to the same bytes in both compatibility modes.\n- C#: 377 runtime/generator tests and 29 IDL tests passed; focused Java\npeer tests passed.\n- Rust: 63 derive tests, 4 doc tests, and 5 IDL tests passed; Clippy and\nfocused Java peer tests passed.\n- Kotlin: IDL build and 10 Java peer tests passed.\n- Scala: 26 derivation tests, 7 IDL tests, and 26 Java peer tests\npassed.\n- Swift: 282 package tests, 7 IDL tests, and 26 Java peer tests passed;\nlint and formatting passed.\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "7234c41bec3f188aa9b7bbb2aa0cebad6c97ee6b",
      "tree": "ba1758bafcc345dd7bce85a32438f0bc20509e34",
      "parents": [
        "34890aed7c28b62193a98d468097a0cdc4a2ee22"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 14:08:48 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 14:08:48 2026 +0800"
      },
      "message": "ci: Bump com.fasterxml.jackson.core:jackson-core from 2.18.8 to 2.18.11 in /java/fory-testsuite (#4120)\n\nBumps\n[com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core)\nfrom 2.18.8 to 2.18.11.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/bdda1b30e48cd70cba77205a67520f3d944a4407\"\u003e\u003ccode\u003ebdda1b3\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-core-2.18.11\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/75a90d5ddd7f8b3b6bcce7e0188f82a5214f55f0\"\u003e\u003ccode\u003e75a90d5\u003c/code\u003e\u003c/a\u003e\nPrep for 2.18.11 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/01acf7e759f4b3f66b1096b35c539c1ef102ed34\"\u003e\u003ccode\u003e01acf7e\u003c/code\u003e\u003c/a\u003e\nAdd cve id CVE-2026-89425 for \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1698\"\u003e#1698\u003c/a\u003e\nin release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/89cb5d5808b35d3ad088e84a15386919d78d4fd1\"\u003e\u003ccode\u003e89cb5d5\u003c/code\u003e\u003c/a\u003e\nAdd CVE id for \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1649\"\u003e#1649\u003c/a\u003e\nin release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3\"\u003e\u003ccode\u003e211cf2c\u003c/code\u003e\u003c/a\u003e\nHonor maxErrorTokenLength in UTF8DataInputJsonParser\n[GHSA-7hhh-6rmp-j9qf] (#...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff\"\u003e\u003ccode\u003ee7acd64\u003c/code\u003e\u003c/a\u003e\nBackport \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1649\"\u003e#1649\u003c/a\u003e\nfix to 2.18: optimize \u0026quot;NumberInput.looksLikeValidNumber()\u0026quot; (\u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/a25790e9df1ea9fae120969f013405035dfb6522\"\u003e\u003ccode\u003ea25790e\u003c/code\u003e\u003c/a\u003e\n...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/7cec938fe0de0918a4bcf0b694b1d72984b8b19f\"\u003e\u003ccode\u003e7cec938\u003c/code\u003e\u003c/a\u003e\nFix CI fail wrt \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1643\"\u003e#1643\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/f8dc7d77b4d743801b40dca4501ea2685ba69808\"\u003e\u003ccode\u003ef8dc7d7\u003c/code\u003e\u003c/a\u003e\nPost-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/7add1bf0be43a70384c87c92d28076c831edbd5c\"\u003e\u003ccode\u003e7add1bf\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/compare/jackson-core-2.18.8...jackson-core-2.18.11\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson.core:jackson-core\u0026package-manager\u003dmaven\u0026previous-version\u003d2.18.8\u0026new-version\u003d2.18.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "34890aed7c28b62193a98d468097a0cdc4a2ee22",
      "tree": "584e7fbe46eb82cdbb244edaa9f13d6a354ba71b",
      "parents": [
        "1d0a64ed6130aad50ff27eff398b6c264e64c160"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Oct 04 16:56:57 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 16:56:57 2026 +0530"
      },
      "message": "ci: Bump com.fasterxml.jackson.core:jackson-core from 2.18.8 to 2.18.11 in /java/fory-test-core (#4115)\n\nBumps\n[com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core)\nfrom 2.18.8 to 2.18.11.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/bdda1b30e48cd70cba77205a67520f3d944a4407\"\u003e\u003ccode\u003ebdda1b3\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-core-2.18.11\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/75a90d5ddd7f8b3b6bcce7e0188f82a5214f55f0\"\u003e\u003ccode\u003e75a90d5\u003c/code\u003e\u003c/a\u003e\nPrep for 2.18.11 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/01acf7e759f4b3f66b1096b35c539c1ef102ed34\"\u003e\u003ccode\u003e01acf7e\u003c/code\u003e\u003c/a\u003e\nAdd cve id CVE-2026-89425 for \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1698\"\u003e#1698\u003c/a\u003e\nin release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/89cb5d5808b35d3ad088e84a15386919d78d4fd1\"\u003e\u003ccode\u003e89cb5d5\u003c/code\u003e\u003c/a\u003e\nAdd CVE id for \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1649\"\u003e#1649\u003c/a\u003e\nin release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/211cf2c5d91abbec38067f37efc1363cd4e88ee3\"\u003e\u003ccode\u003e211cf2c\u003c/code\u003e\u003c/a\u003e\nHonor maxErrorTokenLength in UTF8DataInputJsonParser\n[GHSA-7hhh-6rmp-j9qf] (#...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff\"\u003e\u003ccode\u003ee7acd64\u003c/code\u003e\u003c/a\u003e\nBackport \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1649\"\u003e#1649\u003c/a\u003e\nfix to 2.18: optimize \u0026quot;NumberInput.looksLikeValidNumber()\u0026quot; (\u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/a25790e9df1ea9fae120969f013405035dfb6522\"\u003e\u003ccode\u003ea25790e\u003c/code\u003e\u003c/a\u003e\n...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/7cec938fe0de0918a4bcf0b694b1d72984b8b19f\"\u003e\u003ccode\u003e7cec938\u003c/code\u003e\u003c/a\u003e\nFix CI fail wrt \u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1643\"\u003e#1643\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/FasterXML/jackson-core/issues/1702\"\u003e#1702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/f8dc7d77b4d743801b40dca4501ea2685ba69808\"\u003e\u003ccode\u003ef8dc7d7\u003c/code\u003e\u003c/a\u003e\nPost-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/commit/7add1bf0be43a70384c87c92d28076c831edbd5c\"\u003e\u003ccode\u003e7add1bf\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-core/compare/jackson-core-2.18.8...jackson-core-2.18.11\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson.core:jackson-core\u0026package-manager\u003dmaven\u0026previous-version\u003d2.18.8\u0026new-version\u003d2.18.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "1d0a64ed6130aad50ff27eff398b6c264e64c160",
      "tree": "e4ec835e0be6a5ef80a6f1361a6865d69fad0e59",
      "parents": [
        "57ed53124e61edbd0a88b7cb8897c3f21907304e"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Sun Oct 04 15:52:27 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 15:52:27 2026 +0530"
      },
      "message": "fix(compiler): fix Java, Kotlin and Scala codegen emission bugs (#4109)\n\n## What does this PR do?\n\nFixes five code-emission bugs in the Java, Kotlin and Scala compiler\ngenerators:\n\n- Java: union cases of duration/decimal types emitted `Types.UNKNOWN`\ninstead of `Types.DURATION`/`Types.DECIMAL`, producing a wrong wire type\nid.\n- Java: reserved-word field names were never escaped, so a field such as\n`string class \u003d 1;` generated `private String class;`, which does not\ncompile; a field or union case named `class` also generated\n`getClass()`, clashing with the final `Object.getClass()`.\n- Java: optional list elements and map values lost the `@Nullable`\ntype-use annotation, so generated Java treated them as non-null while\nKotlin, Scala and Go emit nullable for the same schema.\n- Java/Kotlin/Scala: a schema type named after a module-file runtime\nimport (e.g. `message Fory`) compiled but silently registered the wrong\nclass; registrations of shadowed names are now package-qualified, and a\nshadowed name in the default package is rejected with a clear error.\n- Kotlin: `message Empty {}` generated `data class Empty()`, which does\nnot compile; empty messages now use a plain class.\n\n## Verification\n\nRegression tests added for each bug; each fails without its\ncorresponding generator fix. Full compiler suite passes: `python3 -m\npytest fory_compiler/tests -q` (500 passed, 1 skipped).\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "57ed53124e61edbd0a88b7cb8897c3f21907304e",
      "tree": "a1f79cca629b3b9a0f389ef93662dd7b6c0a787f",
      "parents": [
        "61d4063177f5cf6b2bcbaefedcaafa1083db0f16"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Sun Oct 04 15:51:42 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 15:51:42 2026 +0530"
      },
      "message": "fix(compiler): escape Python field names that shadow generated default helpers (#4107)\n\n## What does this PR do?\n\nA schema such as `message Tricky { string pyfory \u003d 1; list\u003cstring\u003e tags\n\u003d 2; }` generates a dataclass whose `pyfory` attribute shadows the\nmodule-level `pyfory` import, so later field defaults like\n`pyfory.field(id\u003d2, ...)` raise `AttributeError` when the generated\nmodule is imported. The same shadowing happens for fields named `field`,\n`decimal`, `list`, or `dict`, which are all referenced by generated\ndefault expressions. This PR escapes those field names with a trailing\nunderscore, reusing the existing keyword-escaping convention. The wire\nfield name is unchanged because pyfory\u0027s `_to_snake_case` strips the\ntrailing underscore when deriving the serialized field name.\n\nVerification: the new regression test fails without the generator change\nand passes with it; the full compiler suite (`python3 -m pytest\nfory_compiler/tests`) passes (492 passed, 1 skipped).\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "61d4063177f5cf6b2bcbaefedcaafa1083db0f16",
      "tree": "352c61c8c9e8ad13211708fe9d2bf7e6f3c46bcf",
      "parents": [
        "e6748688e9ad805ba3685c0852249b22877aa7c7"
      ],
      "author": {
        "name": "Chang-Yen (Brian) Li",
        "email": "b09902054@csie.ntu.edu.tw",
        "time": "Sun Oct 04 04:16:13 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 14:46:13 2026 +0530"
      },
      "message": "perf(cpp): serialize forward_list without a temporary vector (#4113)\n\n\u003c!--\n**Thanks for contributing to Apache Fory™.**\n\n**If this is your first time opening a PR on fory, you can refer to\n[CONTRIBUTING.md](https://github.com/apache/fory/blob/main/CONTRIBUTING.md).**\n\nContribution Checklist\n\n- The **Apache Fory™** community has requirements on the naming of PR\ntitles. You can also find instructions in\n[CONTRIBUTING.md](https://github.com/apache/fory/blob/main/CONTRIBUTING.md).\n\n- Apache Fory™ has a strong focus on performance. If the PR you submit\nwill have an impact on performance, benchmark it first and provide the\nbenchmark result here.\n--\u003e\n\n## Why?\n\nThe collection wire format requires the element count before the\nelements are written, but `std::forward_list` has no `size()` method.\nIts generic serializer previously worked around this by collecting\nelement references in a temporary vector and then serializing from that\nvector. Growing the vector introduces repeated heap allocations and\nmoves of existing reference entries, even though serialization only\nneeds the count and access to the original elements. A counting pass\nfollowed by direct serialization avoids this temporary storage and its\nallocation overhead.\n\nThe generic serializer also duplicated the shared fast collection\nwriter\u0027s header, type-information, null-handling, and element-writing\nlogic. Passing the counted length to the shared writers lets\n`forward_list` reuse the existing collection encoding instead of\nmaintaining a separate copy of the fast path.\n\n## What does this PR do?\n\nThe shared collection writers now accept an explicit length, allowing\nthem to serialize containers that have no `size()` method. The\n`forward_list` serialization path becomes:\n\n1. `write()` calls `write_data_generic()`, which traverses the list to\ncount its elements and checks that the count fits in `uint32_t`.\n2. For non-polymorphic, non-shared-reference elements, it calls\n`write_collection_data_fast()` with the original list and the computed\nlength. This replaces the duplicated fast-path logic previously embedded\nin `write_data_generic()`; the shared writer now handles the collection\nheader, element type information, null flags, and element serialization.\n3. For polymorphic or shared-reference elements, it calls\n`write_collection_data_slow()` with the original list and the computed\nlength. That writer retains its existing runtime-type, null, and\nreference handling while iterating directly over the list.\n\nBoth paths serialize from the original `forward_list`, eliminating the\ntemporary vector and the helper that unwrapped its `reference_wrapper`\nentries. Containers with `size()` continue to obtain their length from\n`size()` and delegate to the same writers, with a `uint32_t` range check\nbefore writing the length. The wire format and public API are unchanged.\n\nAdded wire-equivalence coverage for non-nullable strings, nullable\nscalar elements, and shared-reference elements. The full C++\nserialization suite passes: 14 test targets.\n\n## Related issues\n\nNone known.\n\n## AI Contribution Checklist\n\n\u003c!-- Full requirements and disclosure template:\n\nhttps://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs\n\nThe checklist below is intentionally left unanswered for the contributor\nto complete.\n--\u003e\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] If `yes`, I included the standardized `AI Usage Disclosure` block\nbelow.\n- [x] If `yes`, I can explain and defend all important changes without\nAI help.\n- [x] If `yes`, I reviewed AI-assisted code changes line by line before\nsubmission.\n- [x] If `yes`, I completed line-by-line self-review first and fixed\nissues before requesting AI review.\n- [x] If `yes`, I ran two fresh AI review agents on the current PR diff\nor current HEAD after the latest code changes: one Fory-guided reviewer\nusing `AGENTS.md` and `.agents/ci-and-pr.md`, and one independent\ngeneral reviewer in a separate clean-context review session that was not\npointed to `.agents/ci-and-pr.md` or any copied Fory-specific review\nchecklist. If the independent reviewer\u0027s tooling auto-loaded\n`AGENTS.md`, it followed the independent-review carve-out there.\n- [x] If `yes`, I addressed all AI review comments and repeated the\nreview loop until both AI reviewers reported no further actionable\ncomments.\n- [x] If `yes`, I attached screenshot evidence or equivalent persisted\nlinks of the final clean AI review results from both fresh reviewers on\nthe current PR diff or current HEAD after the latest code changes in\nthis PR body.\n- [artifact1.md — Fory-guided\nreview](https://gist.github.com/BrianLii/025b16a4368678d81f77d5bae6396965)\n- [artifact2.md — Independent\nreview](https://gist.github.com/BrianLii/bc8b9c269df99220a6fcd636cbdfb1f7)\n- [x] If `yes`, I ran adequate human verification and recorded evidence\n(checks run locally or in CI, pass/fail summary, and confirmation I\nreviewed results).\n- [x] If `yes`, I added or updated tests and specs where required.\n- [x] If `yes`, I validated protocol and performance impacts with\nevidence when applicable.\n- [x] If `yes`, I verified licensing and provenance compliance.\n\nAI Usage Disclosure (only when substantial AI assistance \u003d `yes`):\n\n```text\nAI Usage Disclosure\n- substantial_ai_assistance: \u003cyes or no\u003e\n- scope: code drafting, refactor suggestions, tests\n- affected_files_or_subsystems: \u003chigh-level paths/modules\u003e\n- ai_review: Two fresh reviewers (one Fory-guided and one independent) reviewed the current HEAD; both reported no actionable findings.\n- ai_review_artifacts: linked in the checklist above\n- human_verification: checked the unit tests and the benchmark results locally\n- performance_verification: benchmark result provided in the PR description\n- provenance_license_confirmation: no incompatible third-party code introduced\n```\n\n## Does this PR introduce any user-facing change?\n\nNo public API or binary protocol changes.\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\nRelease C++17 benchmark on Darwin arm64 with AppleClang 21.0.0. Each\nprocess serializes a prebuilt 1,024-element `std::forward_list\u003cint64_t\u003e`\ninto a reused output buffer reserved to 65,536 bytes. It uses\n`Fory::builder().xlang(true).compatible(true).track_ref(false)` and\nperforms 1,000 warmup serializations before measurement. Each latency\nresult is the median of nine samples, with 10,000 serializations per\nsample. Four baseline/change process pairs were run consecutively.\n\n| Pair | Base `8acb8ca7` |         Change | Change |\n| ---: | --------------: | -------------: | -----: |\n|    1 |  2,698.84 ns/op | 2,459.49 ns/op |  -8.9% |\n|    2 |  2,745.90 ns/op | 2,408.87 ns/op | -12.3% |\n|    3 |  2,605.29 ns/op | 2,335.52 ns/op | -10.4% |\n|    4 |  2,692.01 ns/op | 2,395.23 ns/op | -11.0% |\n\nThe full C++ serialization suite passed: 14 test targets."
    },
    {
      "commit": "e6748688e9ad805ba3685c0852249b22877aa7c7",
      "tree": "b87c15915fa454409f6eec5e723ce493d42a1f68",
      "parents": [
        "7b1f3062eeddc46ab0e5d7a0501502475d5a1158"
      ],
      "author": {
        "name": "Pavel Ptashyts",
        "email": "49400901+pavel-ptashyts@users.noreply.github.com",
        "time": "Sun Oct 04 11:15:33 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 14:45:33 2026 +0530"
      },
      "message": "perf(java): skip runtime NON_EMPTY checks for final JSON property types (#4111)\n\n## Why?\n\nSince #4074 the generated JSON writer calls\n`JsonFieldInfo.isEmpty(value, wpN.writeTypeInfo(), writer)` for every\nomit-empty property whose declared type is not a `CharSequence`, array,\n`Collection`, `Map` or `Optional*`. For boxed numbers, `Boolean`, enums\nand other final types that call can only ever return `false`, yet every\nwrite pays the `instanceof` chain in `JsonFieldInfo.isEmpty` plus an\ninterface call to the codec. With `NON_EMPTY` as the default inclusion\nthis makes writes of number-heavy beans about 2.2 times slower than in\n1.7.3 (details and a reproducer in #4105).\n\n## What does this PR do?\n\n- `JsonWriterCodegen.neverEmpty` decides the emptiness check while the\nwriter is generated: when `JsonFieldInfo.mayBeEmpty()` rules out every\nbuilt-in empty type (a final or enum declared type) and neither the\nproperty\u0027s write codec class nor any of its superclasses or\nsuperinterfaces declares `isEmpty` (only the `JsonValueCodec` default\napplies), the generated String and UTF-8 writers emit only the null\ncheck, and `fieldWriteSize` no longer counts a check that is not\nemitted.\n- Everything else keeps the runtime call: non-final declared types,\nwhose runtime value may still be a string, collection or map (this\nincludes `BigDecimal` and `BigInteger`, which are not final), and codecs\nthat override `isEmpty`, whether they come from `registerCodec`, a codec\nfactory, `@JsonCodec` or a Mixin.\n- The decision stays in code generation on purpose. Native images\nresolve types at run time without reflection metadata for codec methods,\nso the reflective `isEmpty` lookup must not run in\n`JsonFieldInfo.resolveTypes`.\n- Generated writer classes are shared across `ForyJson` instances. The\ndecision depends only on the declared type, fixed by the owner class,\nand on the write codec class, which the generated class key already\ncarries (`EXACT_CODEC`, `FACTORY`, `MIXIN`);\n`GeneratedCodecKeyBuilder.addRegistration` now notes that dependency.\nThe `mayBeEmpty` and `isEmpty` javadocs point at each other, since the\nbuilt-in empty types must stay in sync.\n- Tests in `JsonGeneratedCodecTest`:\n- `nonEmptyFinalValues` inspects the generated String and UTF-8 writer\nsources (no runtime check for `Integer`, `Long`, a plain enum, an enum\nwith constant bodies and a final bean; the check kept for a final type\nwith an `isEmpty`-overriding `@JsonCodec`, for `BigDecimal` and for\n`Object`), checks the written JSON, and compares every fixture,\nincluding a 31-property bean that moves the generated group boundaries,\nwith the interpreted writer. The wide bean\u0027s source is checked too, and\nit is split into member helpers, so the grouped writer shape is covered.\nIt fails without the codegen change.\n- `nonEmptyRegisteredCodec` builds two instances in one JVM, one with a\ndefault-emptiness codec and one with an `isEmpty`-overriding codec for\nthe same final type, through `registerCodec`, a codec factory, a Mixin,\na codec inheriting `isEmpty` from an interface and one inheriting it\nfrom an abstract base class. It checks that both instances run different\ngenerated UTF-8 writers, that only the overriding one keeps the runtime\ncheck, and that it still omits the empty value after the other one\ngenerated its writer. It fails if the codec override, or the interface\nor superclass part of the walk, is ignored.\n- `builtInEmptyTypes` asserts `mayBeEmpty()` for every type\n`JsonFieldInfo.isEmpty` tests itself, including an enum implementing\n`CharSequence`, so the two lists cannot drift.\n\n## Related issues\n\n- Fixes #4105\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [x] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\nCompleted checklist from `AI_POLICY.md` section 9:\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] I included the standardized `AI Usage Disclosure` block below.\n- [x] I can explain and defend all important changes without AI help.\n- [x] I reviewed AI-assisted code changes line by line before\nsubmission.\n- [x] I completed line-by-line self-review first and fixed issues before\nrequesting AI review.\n- [x] I ran two fresh AI review agents on the current PR diff or current\nHEAD after the latest code changes: one Fory-guided reviewer using\n`AGENTS.md` and `.agents/ci-and-pr.md`, and one independent general\nreviewer in a separate clean-context review session that was not pointed\nto `.agents/ci-and-pr.md` or any copied Fory-specific review checklist.\n- [x] I addressed all AI review comments and repeated the review loop\nuntil both ai reviewers reported no further actionable comments.\n- [x] I attached equivalent persisted links of the final clean AI review\nresults from both fresh reviewers on the current PR head in this PR\nbody.\n- [x] I ran adequate human verification and recorded evidence (checks\nrun locally, pass/fail summary, and confirmation I reviewed results).\n- [x] I added/updated tests and specs where required.\n- [x] I validated protocol/performance impacts with evidence when\napplicable.\n- [x] I verified licensing and provenance compliance.\n\n```text\nAI Usage Disclosure\n- substantial_ai_assistance: yes\n- scope: investigation, code drafting, tests, benchmark harness, PR text\n- affected_files_or_subsystems: java/fory-json codegen (JsonWriterCodegen) and its generated-codec test\n- ai_review: line-by-line self-review of the AI-drafted change is pending by the contributor (see unchecked items above). Two-reviewer loop on fresh sessions for every round, thirteen rounds. Fixed from review: reuse of JsonFieldInfo.mayBeEmpty instead of a second type list; no `\u0026\u0026 true` / `if (true)` in generated code; group size estimate aligned with the emitted code; the decision kept in code generation after the Fory-guided reviewer found that moving it into resolveTypes breaks native-image resolution; tests for String and UTF-8 sources, enums with constant bodies, final beans, BigDecimal, a wide bean, registered/factory/Mixin codecs across instances, built-in empty type drift, and interpreted-writer equivalence. The codec override check walks the codec class, its superclasses and all superinterfaces instead of relying on Class.getMethod\u0027s choice between interface defaults. Kept by decision: BigDecimal/BigInteger stay on the runtime check (non-final), a Kotlin/Scala fixture for the requiresNonNullWrite arm is out of this Java-only change, no extra cache-key part (the write codec class is already pinned). Final round on the current head: both reviewers report no further actionable comments.\n- ai_review_artifacts: Fory-guided reviewer: https://github.com/apache/fory/pull/4111#issuecomment-5926057531 ; independent general reviewer: https://github.com/apache/fory/pull/4111#issuecomment-5926057955 (both on commit 48dd8d80ee5624dc0341a71eff4dbc75ebefd9fd, final round, no further actionable comments; the current head 384b3824 is the same patch rebased onto main 7919241b with no conflicts, `git range-diff` reports it identical; earlier artifact comments refer to superseded commits)\n- human_verification: see \"Verification\" below\n- performance_verification: see \"Benchmark\" below\n- provenance_license_confirmation: all code written for this PR against the Apache Fory sources; no third-party code introduced\n```\n\n## Verification\n\nJDK 25.0.2, Windows 11 x86_64, from `java/`:\n\n- `mvn -pl fory-json -am install -DskipTests`: success\n- `mvn -pl fory-json test`: 1272 tests, 0 failures, 0 errors, 0 skipped\n- `mvn -pl fory-json test\n-Dtest\u003d\u0027JsonGeneratedCodecTest#nonEmptyFinalValues\u0027` with the\n`JsonWriterCodegen` change reverted: fails, as intended\n- `JsonGeneratedCodecTest#nonEmptyRegisteredCodec` with the\ncodec-override check disabled: fails, as intended\n- `JsonGeneratedCodecTest#builtInEmptyTypes` with `OptionalInt` removed\nfrom `mayBeEmpty`, or with an early enum return in `mayBeEmpty`: fails,\nas intended\n- `JsonGeneratedCodecTest#nonEmptyRegisteredCodec` with the interface or\nthe superclass part of the override walk removed: fails, as intended\n- `mvn -pl fory-json spotless:check checkstyle:check`: success, 0\nCheckstyle violations\n\n## Does this PR introduce any user-facing change?\n\n- [x] Does this PR introduce any public API change? No.\n- [x] Does this PR introduce any binary protocol compatibility change?\nNo. The JSON output is unchanged; only whether the writer asks the codec\nat runtime changes.\n\n## Benchmark\n\nStandalone harness from #4105 (not JMH): a bean with 10 `String`, 20\n`Integer`, 10 `Long`, 2 `Double`, 2 `Boolean`, 3 enum, 2 `BigDecimal`\nproperties and one `List\u003cString\u003e`, all non-null, serialized with\n`ForyJson.toJsonBytes` after a 20 s warm-up; median of 5 rounds of\n2,000,000 writes; one JVM per configuration, run one after another on an\notherwise idle host; JDK 25.0.2, `-Xms1g -Xmx1g`. ns per write, two\nrepetitions:\n\n| Build | `NON_EMPTY` | `NON_NULL` |\n| --- | ---: | ---: |\n| main 341f732b | 761 / 753 | 339 / 331 |\n| this PR | 349 / 341 | 330 / 349 |\n\nThe JSON written is identical between the two builds in both modes\n(compared by digest of the output JSON line). The two `BigDecimal`\nproperties still take the runtime check; the remaining `NON_EMPTY` cost\nover `NON_NULL` is within noise here.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "7b1f3062eeddc46ab0e5d7a0501502475d5a1158",
      "tree": "17c8d4fd7f869c133393facca2e2468a9849bc3c",
      "parents": [
        "7919241bcd3a96d99b5a7b402e6f1c9564bcdd77"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Sun Oct 04 14:43:58 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 14:43:58 2026 +0530"
      },
      "message": "fix(compiler): include null in TS map value types for optional map values (#4108)\n\n## What does this PR do?\n\nFor a schema field like `map\u003cstring, optional string\u003e attrs \u003d 1;`, the\nJavaScript generator declared the TypeScript type as `Map\u003cstring,\nstring\u003e` while the same generated file\u0027s runtime schema registration\ncorrectly emits `.setNullable(true)` on the map value type, so the\ndeclared TS type contradicted the runtime schema and deserialized null\nvalues violated it. The fix is one line: the MapType branch of\n`generate_type` now passes `nullable\u003dfield_type.value_optional` for the\nvalue type, producing `Map\u003cstring, string | null\u003e`, matching how list\nelements already handle optionality.\n\nVerified with a new regression test that fails without the generator\nchange; the full compiler suite (`fory_compiler/tests`) passes."
    },
    {
      "commit": "7919241bcd3a96d99b5a7b402e6f1c9564bcdd77",
      "tree": "291656b578b5ba8a20157c656f01eec845a986d0",
      "parents": [
        "33abafadae8464c19518e994dd4bc7704353eb0d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 05:42:59 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 05:42:59 2026 +0530"
      },
      "message": "ci: Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /benchmarks/java (#4110)\n\nBumps\n[com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind)\nfrom 2.22.2 to 2.22.3.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/4385c5f7d51426f66fb24c3777308acc8ae7ea6c\"\u003e\u003ccode\u003e4385c5f\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-databind-2.22.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/ccb4fd0158cd20800f6014496dccf7332e5b18ce\"\u003e\u003ccode\u003eccb4fd0\u003c/code\u003e\u003c/a\u003e\nPrep for 2.22.3 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/2958412f1817a0ad95c34066b7eb85781dd2d4f1\"\u003e\u003ccode\u003e2958412\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.21\u0027 into 2.22\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/1215b94c2f7a8c4ce3863afbc38275a19c682a54\"\u003e\u003ccode\u003e1215b94\u003c/code\u003e\u003c/a\u003e\nPost-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/1f0df621449e5de7dd13a1538e0343f65f0e6bb3\"\u003e\u003ccode\u003e1f0df62\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/13a9ff4c4ef982cda23b99fea89d2a4e87af9019\"\u003e\u003ccode\u003e13a9ff4\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-databind-2.21.7\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/d168f9679ad575cdc2df8d53a8474ec481c7b5a7\"\u003e\u003ccode\u003ed168f96\u003c/code\u003e\u003c/a\u003e\nPrep for 2.21.7 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/eaf5c76b8e0a538729a1bf922061abf73b13f89b\"\u003e\u003ccode\u003eeaf5c76\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.21\u0027 into 2.22\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/e05ef4cbb4d534a82948f8ba84350e55493bc72e\"\u003e\u003ccode\u003ee05ef4c\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.20\u0027 into 2.21\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/f6d4000c1eb6d34e2ae24685a9790b1e833d4bcb\"\u003e\u003ccode\u003ef6d4000\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.19\u0027 into 2.20\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.2...jackson-databind-2.22.3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson.core:jackson-databind\u0026package-manager\u003dmaven\u0026previous-version\u003d2.22.2\u0026new-version\u003d2.22.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "33abafadae8464c19518e994dd4bc7704353eb0d",
      "tree": "9f199d707f30d856f89044614a2cf62ecbc2af01",
      "parents": [
        "341f732b8ba1beb9e799e2ffb4d1ebefdee1ec9d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 02:34:52 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 02:34:52 2026 +0800"
      },
      "message": "ci: Bump brace-expansion from 1.1.18 to 1.1.21 in /javascript (#4104)\n\nBumps [brace-expansion](https://github.com/juliangruber/brace-expansion)\nfrom 1.1.18 to 1.1.21.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/commit/8e81e187b6e9c6c723d16c042657c00acefc2483\"\u003e\u003ccode\u003e8e81e18\u003c/code\u003e\u003c/a\u003e\n1.1.21\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e\"\u003e\u003ccode\u003effdfa3e\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/commit/c6513ad31e08edb56dc414a629e39cba724b7548\"\u003e\u003ccode\u003ec6513ad\u003c/code\u003e\u003c/a\u003e\n1.1.20\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b\"\u003e\u003ccode\u003e1efee7c\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/commit/a34340a053abb475cc226aeb3f71887018e71bd0\"\u003e\u003ccode\u003ea34340a\u003c/code\u003e\u003c/a\u003e\n1.1.19\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc\"\u003e\u003ccode\u003e0bcbfc0\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dbrace-expansion\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d1.1.18\u0026new-version\u003d1.1.21)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "341f732b8ba1beb9e799e2ffb4d1ebefdee1ec9d",
      "tree": "443d9ede9d308d5dcd654c812b7a430c0911cf93",
      "parents": [
        "db699c99c213732905b251f4c83c16c4edcb7f20"
      ],
      "author": {
        "name": "PJ Fanning",
        "email": "pjfanning@users.noreply.github.com",
        "time": "Wed Sep 30 16:44:32 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 21:14:32 2026 +0530"
      },
      "message": "fix(javascript): improve hps string writing (#4098)\n\n## What does this PR do?\n\nImproves how the JavaScript hps string writer handles buffers:\n\n- `BinaryWriter` reserves space before using the hps string path.\n- The `@apache-fory/hps` wrapper validates the destination buffer.\n- The native writer respects the `Uint8Array` view offset.\n\nAdds tests in `test/hps.test.ts`.\n\nNote: the hps addon only builds on Node 20, and the JS CI matrix runs\nNode 18 and 24, so the hps tests are skipped in CI. Verified locally\nwith `npm test` on Node 20 (391 tests passed).\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "db699c99c213732905b251f4c83c16c4edcb7f20",
      "tree": "668b4cff4c95aa195b53c011ed3fa98a11f00e04",
      "parents": [
        "14039c4a327e9b066ec035f99d5118a2b254d2c0"
      ],
      "author": {
        "name": "Pavel Ptashyts",
        "email": "49400901+pavel-ptashyts@users.noreply.github.com",
        "time": "Wed Sep 30 16:09:58 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 19:39:58 2026 +0530"
      },
      "message": "fix(java): keep JSON string writer prefix field names unique past 160 properties (#4099)\n\n## Why?\n\nThe generated JSON string writer fails to load for a type with 161 or\nmore properties: `ClassFormatError: Duplicate field name \"s160\"`. With\nsynchronous compilation every operation on such a type throws (including\n`toJsonBytes` and `fromJson`, since the string writer is built with the\ntype\u0027s codec graph); with the default asynchronous compilation the\nfailure is silent and the type stays on the interpreted codec for good.\n\n## What does this PR do?\n\n`StringWriterCodegen` names its per-property prefix fields from the\nproperty index: `\"s\" + id` / `\"sc\" + id` for Latin1 and `\"s16\" + id` /\n`\"sc16\" + id` for UTF-16. `\"s\" + 160` and `\"s16\" + 0` are both `s160`\n(and `\"sc\" + 160` / `\"sc16\" + 0` both `sc160`). This PR adds a separator\nto the UTF-16 names, `\"s16_\" + id` / `\"sc16_\" + id`, at the declaration\n(`addPrefixFields`) and at the only reference (`utf16PrefixRef`). The\nother generated field names in the JSON writers and readers (`s`, `sc`,\n`u`, `uc`, `w`, `wp`, `r`, `rp`, `o`, `p`, ...) are letters followed by\nthe index, so they cannot collide this way.\n\nRegression test\n`JsonGeneratedCodecTest#writeGeneratedFieldsPastPrefixIndexCollision`\ncompiles a 161-property model with Janino, writes it with a non-Latin1\ncharacter in the first value so the string writer takes the UTF-16\nprefix path, and checks `toJson`, `toJsonBytes`, `fromJson` and that the\ntype has generated codecs. It fails on main with the `ClassFormatError`\nabove and passes with the fix.\n\n## Related issues\n\nCloses #4094\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`\n- [x] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [x] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n- [x] I can explain and defend all important changes without AI help.\n- [x] I reviewed AI-assisted code changes line by line before\nsubmission.\n- [x] I completed line-by-line self-review first and fixed issues before\nrequesting AI review.\n- [x] I ran two fresh AI review agents on the current HEAD: one\nFory-guided reviewer using `AGENTS.md` and `.agents/ci-and-pr.md`, and\none independent general reviewer in a separate clean-context session\nthat was not pointed to `.agents/ci-and-pr.md`; it auto-loaded\n`AGENTS.md` and followed the independent-review carve-out.\n- [x] I addressed all AI review comments and repeated the review loop\nuntil both reviewers reported no further actionable comments.\n- [x] I attached equivalent persisted links of the final clean AI review\nresults from both reviewers on the current HEAD.\n- [x] I ran adequate human verification and recorded evidence.\n- [x] I added tests where required.\n- [x] I validated protocol/performance impacts with evidence when\napplicable.\n- [x] I verified licensing and provenance compliance.\n\n```text\nAI Usage Disclosure\n- substantial_ai_assistance: yes\n- scope: code drafting, tests\n- affected_files_or_subsystems: java/fory-json codegen (StringWriterCodegen), java/fory-json tests (JsonGeneratedCodecTest)\n- ai_review: line-by-line self-review completed; Fory-guided reviewer (Codex, AGENTS.md + .agents/ci-and-pr.md) and independent general reviewer (Claude Code, clean session, independent-review carve-out) both reviewed HEAD 5ac69d0d against main 14039c4a and both reported NO FURTHER ACTIONABLE COMMENTS (an earlier pass on 33c1e0b2 was clean as well; the only change since is the test literal written as an \\u0100 escape)\n- ai_review_artifacts: https://gist.github.com/pavel-ptashyts/d483b8788c5417264c7a99a0e4197098 (prompts and full outputs of both reviewers; the verdict is at the end of each log)\n- human_verification: from java/: `mvn -pl fory-json -am install -DskipTests`, then `mvn -pl fory-json test` -\u003e Tests run: 1269, Failures: 0, Errors: 0, Skipped: 0 (after the final test-literal change `-Dtest\u003dJsonGeneratedCodecTest` -\u003e 28 run, 0 failures); the new test fails on main with ClassFormatError: Duplicate field name \"s160\" before the fix; `mvn -pl fory-json spotless:check` and `checkstyle:check` -\u003e BUILD SUCCESS; JDK 25.0.2, Windows 11; results reviewed\n- performance_verification: N/A - only the names of generated fields change; generated code shape and the hot path are unchanged\n- provenance_license_confirmation: Apache-2.0-compatible provenance confirmed; no third-party code introduced\n```\n\n## Does this PR introduce any user-facing change?\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "14039c4a327e9b066ec035f99d5118a2b254d2c0",
      "tree": "5c26609f4532b6c94ab938f12139f66bad331425",
      "parents": [
        "aaab52123ab58134f8c3fdad4c4e931769587562"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 30 18:41:58 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 16:11:58 2026 +0530"
      },
      "message": "perf(java): reduce codegen cost (#4097)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n#4093 \n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "aaab52123ab58134f8c3fdad4c4e931769587562",
      "tree": "af573ae38fca44e89e09b9678d2c2a9f9129d2a5",
      "parents": [
        "3da5d08a916ebe26c84ccc39a1759b589b00d6a6"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 30 17:20:07 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 14:50:07 2026 +0530"
      },
      "message": "perf(java): eliminate JSON codec sizing trial compilations (#4096)\n\n## Why?\n\nGenerating a JSON codec repeatedly compiled complete candidate classes\njust to measure generated method sizes. This made first-use construction\ndisproportionately expensive as the number of fields increased.\n\n\n\n## What does this PR do?\n\n- Replace runtime sizing trial compilations with estimates of emitted\nreader/writer operations, generating and compiling each capability once.\nMerge short trailing groups and count child codec invocations without\nincluding their method bodies.\n- Use explicit no-checked-exception contracts for known reader, writer,\nand prefix-metadata calls instead of repeatedly scanning method\nhierarchies.\n- Group field names and hashes once during switch construction while\npreserving declaration order, collision resolution, and fallback\nbehavior.\n- Add bytecode-boundary coverage using real generated String-field and\nMap-field codecs across all five reader/writer capabilities, and update\nthe Java code-generation guidance.\n\nValidation on this PR head: 1,268 JSON tests passed on JDK 25; 27\nfocused generated-codec tests passed on JDK 21; Spotless and Checkstyle\npassed; the GraalVM 25 native ForyJsonExample built and ran\nsuccessfully.\n\n\n\n## Related issues\n\n#4093 \n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\nLower first-use latency when generating Java JSON codecs. No public API,\nJSON semantics, or binary protocol compatibility changes.\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\nOpenJDK 25.0.3 on macOS ARM64, using the issue\u0027s unchanged ScaleProbe\nwith synchronous compilation. Two adjacent baseline/current pairs per\ncase against `apache/main` at\n`3da5d08a916ebe26c84ccc39a1759b589b00d6a6`. Times are median main-thread\nCPU milliseconds; speedups are median paired ratios. \"Warm\" means first\nconstructing a different 10-field type in the same JVM, not reusing the\nmeasured type\u0027s cached codec.\n\n| Mode | Fields | Baseline CPU ms | PR CPU ms | Speedup |\n| --- | ---: | ---: | ---: | ---: |\n| Cold | 100 | 5261.2 | 403.9 | 13.03x |\n| Cold | 160 | 12175.3 | 522.7 | 23.46x |\n| Warm | 100 | 4654.9 | 186.8 | 24.92x |\n| Warm | 160 | 11606.1 | 267.7 | 43.36x |\n\nA separate instrumented 100-field run reduced sizing trials from 204 to\nzero and total Janino compilations from 209 to five. Source generation\nfell from 207 calls / 2074 ms to five calls / 76 ms; total Janino time\nfell from 2774 ms to 237 ms. Source generation still has a measurable\ncost.\n\nThe four existing MediaContent JSON read/write JMH cases used one\nfork/thread, three 1-second warmups, five 1-second measurements,\nParallel GC, and two adjacent pairs. Median throughput changes ranged\nfrom -0.57% to +2.83%, with unchanged allocation per operation. No\nrepeatable regression was observed; opposite-sign read-String results on\nthe active desktop limit the precision of the throughput conclusion."
    },
    {
      "commit": "3da5d08a916ebe26c84ccc39a1759b589b00d6a6",
      "tree": "f89a6f73802b1a7f5676c3c4388819dbe7ba379a",
      "parents": [
        "17c873576cc6b9b1400b421db0c14307ee48822e"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 30 16:02:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 13:32:20 2026 +0530"
      },
      "message": "feat(json): add read-side null handling (#4095)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #4090\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "17c873576cc6b9b1400b421db0c14307ee48822e",
      "tree": "153a69b82ac6d51463aede991f7fd39921618fcd",
      "parents": [
        "963cb378f710e113c42dd24e052c19e8f142eb50"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 30 10:18:33 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 07:48:33 2026 +0530"
      },
      "message": "chore: update release references to 1.7.6 (#4092)\n\nUpdate installation commands, dependency examples, and README badges to\nthe released Apache Fory 1.7.6 version, and add the Dart 1.7.6 changelog\nentries. Active package/build metadata remains on the existing 1.8.0\ndevelopment versions.\n\nGenerated the version changes with `ci/release.py bump_version -l all\n-version 1.8.0-dev -release-version 1.7.6`. Verified that every changed\nfile contains only the intended version substitutions or changelog\nentries; Markdown formatting and `git diff --check` pass. No local\nbuilds or tests were run for this version-only update."
    },
    {
      "commit": "963cb378f710e113c42dd24e052c19e8f142eb50",
      "tree": "d2c6558bd72d9c863f4b6cb72037c39925f75151",
      "parents": [
        "cbb5083a80ea9df40971c931a09b25cc5c0f955d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 29 07:43:46 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 07:43:46 2026 +0530"
      },
      "message": "ci: Bump undici from 6.28.0 to 6.29.0 in /javascript (#4089)\n\nBumps [undici](https://github.com/nodejs/undici) from 6.28.0 to 6.29.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/nodejs/undici/releases\"\u003eundici\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.29.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[v6.x] fix(retry): settle exposed body on terminal failure by \u003ca\nhref\u003d\"https://github.com/mcollina\"\u003e\u003ccode\u003e@​mcollina\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/pull/5778\"\u003enodejs/undici#5778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBackport upgrade diagnostics lifecycle fixes to v6.x by \u003ca\nhref\u003d\"https://github.com/BridgeAR\"\u003e\u003ccode\u003e@​BridgeAR\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/pull/5833\"\u003enodejs/undici#5833\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etest: synchronize the issue-3356 body timeout by \u003ca\nhref\u003d\"https://github.com/BridgeAR\"\u003e\u003ccode\u003e@​BridgeAR\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/pull/5834\"\u003enodejs/undici#5834\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/nodejs/undici/compare/v6.28.1...v6.29.0\"\u003ehttps://github.com/nodejs/undici/compare/v6.28.1...v6.29.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.28.1\u003c/h2\u003e\n\u003ch2\u003e⚠️ Security fixes\u003c/h2\u003e\n\u003ch3\u003eHigh severity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5\"\u003eGHSA-rfgv-xxqx-mfg5\u003c/a\u003e:\na WebSocket server could select a subprotocol when none was requested,\ncausing an uncaught \u003ccode\u003eTypeError\u003c/code\u003e that could terminate the\nprocess. Undici now rejects the handshake with protocol error 1002.\nFixed by \u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5\"\u003e2af0faf8\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMedium severity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v\"\u003eGHSA-3wwx-pv8p-q78v\u003c/a\u003e:\na malformed permessage-deflate payload exceeding the configured\ndecompression limit could emit an unhandled zlib error and terminate the\nprocess. Undici now destroys the inflater after reaching the limit.\nFixed by \u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c\"\u003e07c60d9c\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eLow severity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r\"\u003eGHSA-r53p-7pc4-xj5r\u003c/a\u003e:\nthe retry interceptor could concatenate a resumed response with\ninconsistent framing into downstream output, enabling response splitting\nor corruption. Undici now validates \u003ccode\u003eContent-Range\u003c/code\u003e against\nthe original response framing before resuming. Fixed by \u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548\"\u003ece31bc82\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eperf: reduce EventSourceStream parser allocations (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5032\"\u003e#5032\u003c/a\u003e)\nby \u003ca href\u003d\"https://github.com/mcollina\"\u003e\u003ccode\u003e@​mcollina\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/pull/5647\"\u003enodejs/undici#5647\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[v6.x] perf(h1): drop idle-socket timer floor with a ref\u0027d\nsetImmediate (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5707\"\u003e#5707\u003c/a\u003e)\nby \u003ca href\u003d\"https://github.com/mcollina\"\u003e\u003ccode\u003e@​mcollina\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/pull/5770\"\u003enodejs/undici#5770\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/nodejs/undici/compare/v6.28.0...v6.28.1\"\u003ehttps://github.com/nodejs/undici/compare/v6.28.0...v6.28.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/e1d0501f8705253c32a8b40bdb3fc0474167c92d\"\u003e\u003ccode\u003ee1d0501\u003c/code\u003e\u003c/a\u003e\nBumped v6.29.0 (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5888\"\u003e#5888\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/57ac4dea0d38a0bf068eaf7eda0b8cb9e86f6a99\"\u003e\u003ccode\u003e57ac4de\u003c/code\u003e\u003c/a\u003e\ntest: synchronize the issue-3356 body timeout (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5834\"\u003e#5834\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/6d441740cf5dad3455a7a7881451e802f10b0b2a\"\u003e\u003ccode\u003e6d44174\u003c/code\u003e\u003c/a\u003e\nBackport upgrade diagnostics lifecycle fixes to v6.x (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5833\"\u003e#5833\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/2a91fc828ecc51865fe7d77376e5f676d030769b\"\u003e\u003ccode\u003e2a91fc8\u003c/code\u003e\u003c/a\u003e\nfix(retry): settle exposed body on terminal failure (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5778\"\u003e#5778\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/ffc8aa0fdd4c54024f384e57784d5047c8b4085a\"\u003e\u003ccode\u003effc8aa0\u003c/code\u003e\u003c/a\u003e\nBumped v6.28.1 (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5773\"\u003e#5773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/3866a3bc4ebaea2c6400db9193c2366072080dc4\"\u003e\u003ccode\u003e3866a3b\u003c/code\u003e\u003c/a\u003e\nperf(h1): drop idle-socket timer floor with a ref\u0027d setImmediate (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5707\"\u003e#5707\u003c/a\u003e)\n(\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5770\"\u003e#5770\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548\"\u003e\u003ccode\u003ece31bc8\u003c/code\u003e\u003c/a\u003e\nfix(retry): validate resumed response framing\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5\"\u003e\u003ccode\u003e2af0faf\u003c/code\u003e\u003c/a\u003e\nfix(websocket): reject unrequested subprotocols\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c\"\u003e\u003ccode\u003e07c60d9\u003c/code\u003e\u003c/a\u003e\nfix(websocket): destroy inflater after decompression limit\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodejs/undici/commit/bd90fff2a6e1350ba87e9b70811c5337502d2e39\"\u003e\u003ccode\u003ebd90fff\u003c/code\u003e\u003c/a\u003e\nperf: reduce EventSourceStream parser allocations (\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5032\"\u003e#5032\u003c/a\u003e)\n(\u003ca\nhref\u003d\"https://redirect.github.com/nodejs/undici/issues/5647\"\u003e#5647\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/nodejs/undici/compare/v6.28.0...v6.29.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dundici\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d6.28.0\u0026new-version\u003d6.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "cbb5083a80ea9df40971c931a09b25cc5c0f955d",
      "tree": "d522440d0e04a717eca55f150ca7debeb19c76b8",
      "parents": [
        "8acb8ca7437ad6a8b5e9e2bfb1d3dfcf8e6845ae"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 29 07:38:26 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 07:38:26 2026 +0530"
      },
      "message": "ci: Bump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2 in /benchmarks/java (#4088)\n\nBumps\n[com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind)\nfrom 2.22.1 to 2.22.2.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/25b2a221f9aa4107e455065a74635e209418cf55\"\u003e\u003ccode\u003e25b2a22\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-databind-2.22.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/bab1c1a702a941f8805ee6698e8fa4fdbfbec54a\"\u003e\u003ccode\u003ebab1c1a\u003c/code\u003e\u003c/a\u003e\nPrep for 2.22.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/bc03cf83d74cf0e5944dce33a63ee59ddc344b64\"\u003e\u003ccode\u003ebc03cf8\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.21\u0027 into 2.22\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/83379fb6409075336edf3d8d88744e95911a43f8\"\u003e\u003ccode\u003e83379fb\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.20\u0027 into 2.21\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/0d400c9dc586fdd460d0c6a40db21ebbe22106d8\"\u003e\u003ccode\u003e0d400c9\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.19\u0027 into 2.20\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/ce36a279f8b078bef2d9d44a1d01034c3634f91a\"\u003e\u003ccode\u003ece36a27\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.18\u0027 into 2.19\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/7a209e1fa97033746db50fd7bcd1e3dbab077599\"\u003e\u003ccode\u003e7a209e1\u003c/code\u003e\u003c/a\u003e\nPost-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/a432707afe6b7569243d1c2d8052a1bf33d9279c\"\u003e\u003ccode\u003ea432707\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/176df1d48b256ced412c65293ad4e09393e24bd3\"\u003e\u003ccode\u003e176df1d\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-databind-2.18.10\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/commit/7785f5f9ed24127e004115472c47b26ea4cf2774\"\u003e\u003ccode\u003e7785f5f\u003c/code\u003e\u003c/a\u003e\nPrep for 2.18.10 release\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.1...jackson-databind-2.22.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson.core:jackson-databind\u0026package-manager\u003dmaven\u0026previous-version\u003d2.22.1\u0026new-version\u003d2.22.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "8acb8ca7437ad6a8b5e9e2bfb1d3dfcf8e6845ae",
      "tree": "5aca70d6080252c35286bfea6613d6b5a409c086",
      "parents": [
        "4a60147b30edbb383b627223887889056ee0ca8d"
      ],
      "author": {
        "name": "Chang-Yen (Brian) Li",
        "email": "b09902054@csie.ntu.edu.tw",
        "time": "Mon Sep 28 02:17:22 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 12:47:22 2026 +0530"
      },
      "message": "perf(cpp): avoid duplicate TypeInfo lookup in compatible reads (#4085)\n\n## Why?\n\nCompatible C++ struct reads look up the local `TypeInfo` a second time\neven when `Serializer\u003cT\u003e::read()` has already resolved it. Removing that\nduplicate lookup reduces work on the compatible deserialization path.\n\n## What does this PR do?\n\nPass the resolved local `TypeInfo` from `Serializer\u003cT\u003e::read()` into the\ncompatible struct-read path. Keep the existing lookup fallback for\ncallers that have only the remote `TypeInfo`.\n\nThis is an internal C++ change. It does not change the public API,\nserialized bytes, schema matching, or field conversion rules.\n\n## Related issues\n\nNone\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used in this PR: `yes`.\n- [x] I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nand the required `AI Usage Disclosure`.\n- [x] I can explain and defend all important changes without AI help.\n- [x] I reviewed AI-assisted code changes line by line before\nsubmission.\n- [x] I completed line-by-line self-review and fixed issues before\nrequesting AI review.\n- [x] I ran two fresh AI review agents on the current PR diff or current\nHEAD after the latest code changes: a Fory-guided reviewer and an\nindependent general reviewer.\n- [x] I addressed all AI review comments and repeated review until both\nreviewers reported no further actionable comments.\n- [x] I attached screenshots or persisted links showing both final clean\nreview results below.\n[Fory Guided\nReviewer](https://gist.github.com/BrianLii/13198f5ced80bd4e5ef91bad37694c08)\n[General\nReviewer](https://gist.github.com/BrianLii/9fd78efd7ee39d0a7c4541ce7d695c64)\n- [x] I ran adequate human verification and reviewed the results.\n- [x] I added or updated tests and specs where required.\n- [x] I validated the performance impact with the benchmark evidence\nbelow.\n- [x] I verified licensing and provenance compliance.\n\n\n\n```\nAI Usage Disclosure\n- substantial_ai_assistance: yes\n- scope: code drafting, performance investigation\n- affected_files_or_subsystems: C++ compatible struct deserialization in `cpp/fory/serialization/struct_serializer.h`\n- ai_review: line-by-line self-review completed; both reviewers reported no further actionable comments.\n- ai_review_artifacts: Fory-guided reviewer\u0027s and independent general reviewer\u0027s feedback are attached. \n- human_verification: Checks run locally.\n- performance_verification: Human verified as described in PR description.\n- provenance_license_confirmation: No incompatible third-party code introduced.\n```\n\n## Does this PR introduce any user-facing change?\n\n\n\nNo.\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\nThe benchmark compares from a fresh Release build of `main`\n(`a56d0dd16`).\n\nEnvironment: macOS Darwin 25.6.0, arm64, AppleClang 21.0.0\n\nThe workload enabled `FORY_BENCH_SCHEMA_MISMATCH\u003d1`: the writer uses the\nv1 benchmark structs and the reader uses the v2 structs, so each\noperation enters the compatible schema-read path.\n\nEach case was run with 7 repetitions and a minimum time of 4 seconds per\nrepetition. The table reports the median CPU time change. The negative\ndelta indicates lower latency.\n\nSet `SIDE` and `CASE` to the selected values, and use the Release\nexecutable built from that side.\n\n```bash\nSIDE\u003dmain # or current\nCASE\u003dNumericStruct\nFORY_BENCH_SCHEMA_MISMATCH\u003d1 benchmarks/cpp/build/fory_benchmark \\\n  --benchmark_format\u003djson \\\n  --benchmark_out\u003dbenchmark-evidence/${SIDE}-${CASE}.json \\\n  --benchmark_filter\u003d\"^BM_Fory_${CASE}_Deserialize$\" \\\n  --benchmark_min_time\u003d4s \\\n  --benchmark_repetitions\u003d7 \\\n  --benchmark_report_aggregates_only\u003dtrue\n```\n\n| Benchmark     | `main` CPU ns/op | Current CPU ns/op |  Delta |\n| ------------- | ---------------: | ----------------: | -----: |\n| NumericStruct |           38.713 |            36.150 | -6.71% |\n\nVerification completed on the current commit:\n\n- `cmake -S benchmarks/cpp -B benchmarks/cpp/build\n-DCMAKE_BUILD_TYPE\u003dRelease` passed on the current commit.\n- `cmake --build benchmarks/cpp/build -j8` passed on the current commit.\n- The equivalent Release benchmark build from `main` passed in a\nseparate build tree.\n- `bazel test //cpp/fory/serialization:struct_compatible_test\n--test_output\u003derrors` passed.\n- `mvn -T16 install -DskipTests` passed from `java/`.\n- `PATH\u003d/tmp:$PATH FORY_CPP_JAVA_CI\u003d1 ENABLE_FORY_DEBUG_OUTPUT\u003d1 mvn\n-T16 test -Dtest\u003dorg.apache.fory.xlang.CPPXlangTest` passed: 97 tests, 0\nfailures, 0 errors, and 2 skipped."
    },
    {
      "commit": "4a60147b30edbb383b627223887889056ee0ca8d",
      "tree": "047fcb05c86c7fc4025dcf6af614cdfeafd4ba5f",
      "parents": [
        "75c6db3e2c235a4abd41ebee54f6fadd8e3c6abc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 28 11:56:34 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 11:56:34 2026 +0530"
      },
      "message": "ci: Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /integration_tests/grpc_tests/go (#4087)\n\nBumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from\n1.83.1 to 1.83.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/releases\"\u003egoogle.golang.org/grpc\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 1.83.2\u003c/h2\u003e\n\u003ch1\u003eSecurity\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eserver: Reject requests missing both \u003ccode\u003e:authority\u003c/code\u003e and\n\u003ccode\u003eHost\u003c/code\u003e headers with HTTP 400 and status\n\u003ccode\u003eInternal\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/pull/9365\"\u003egrpc/grpc-go#9365\u003c/a\u003e)\n\u003cul\u003e\n\u003cli\u003eSpecial Thanks: \u003ca\nhref\u003d\"https://github.com/winklemad\"\u003e\u003ccode\u003e@​winklemad\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/030ee8becb20ce4315d6bf2dfa26bdd876169dc4\"\u003e\u003ccode\u003e030ee8b\u003c/code\u003e\u003c/a\u003e\nUpdate version to 1.83.2 (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9375\"\u003e#9375\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4\"\u003e\u003ccode\u003e8668b69\u003c/code\u003e\u003c/a\u003e\ncherry-pick \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9365\"\u003e#9365\u003c/a\u003e to\nv1.83.x (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9366\"\u003e#9366\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/a3e952d2b7c973b7ec6357676e55a2a9c9faaa0d\"\u003e\u003ccode\u003ea3e952d\u003c/code\u003e\u003c/a\u003e\ncherry-pick \u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9346\"\u003e#9346\u003c/a\u003e to\nv1.83.x and update x/net dependency (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9369\"\u003e#9369\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/commit/58f8fd9a002536548ac96e34621d761b29cc4f3e\"\u003e\u003ccode\u003e58f8fd9\u003c/code\u003e\u003c/a\u003e\nChange version to 1.83.2-dev (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-go/issues/9337\"\u003e#9337\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dgoogle.golang.org/grpc\u0026package-manager\u003dgo_modules\u0026previous-version\u003d1.83.1\u0026new-version\u003d1.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "75c6db3e2c235a4abd41ebee54f6fadd8e3c6abc",
      "tree": "dd6c8a4f5ee79cf1dd1ce2f944f9dd40757ce77b",
      "parents": [
        "4cfadbb041c7a0f347cfe1ed4608cf4524aa5da4"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 28 14:24:41 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 11:54:41 2026 +0530"
      },
      "message": "fix(integration): resolve Go generated package for Dependabot (#4086)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "4cfadbb041c7a0f347cfe1ed4608cf4524aa5da4",
      "tree": "e1be691ac17a5dee19e043ae0485dae2d4190d9b",
      "parents": [
        "feeb8f5f23dbf26b21ba4328400e611170bee60f"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 27 18:10:34 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 27 18:10:34 2026 +0800"
      },
      "message": "ci: restore OpenJ9 setup with Semeru (#4084)\n\n## Why?\n\nThe [OpenJ9 Java CI\njob](https://github.com/apache/fory/actions/runs/36309324067/job/108592116831)\nfails during JDK setup with `No supported distribution was found for\ninput adopt-openj9`. The [setup-java v6 migration\nguide](https://github.com/actions/setup-java/blob/v6/README.md#v6)\nreplaces `adopt-openj9` with `semeru`.\n\n## What does this PR do?\n\n- Use `semeru` for the existing OpenJ9 JDK 21 job.\n- Include `.github/workflows/ci.yml` in the existing Java path filter so\nworkflow updates exercise OpenJ9 and the Java matrix before merge.\n\n## Validation\n\n- `yamllint .github/workflows/ci.yml`: passed; existing comment-spacing\nwarnings only.\n- `git diff --check`: passed.\n- Parsed the workflow and executed its Java path-filter expression\nagainst workflow, Java, Android, README, and Go paths: expected matches\nand exclusions passed.\n- Confirmed the OpenJ9 job still selects JDK 21 with\n`actions/setup-java@v6`.\n- [OpenJ9 Java CI\n(21)](https://github.com/apache/fory/actions/runs/36310990456/job/108596759958):\npassed. The runtime reports IBM Semeru Runtime Open Edition and Eclipse\nOpenJ9 VM, and Maven finishes with BUILD SUCCESS.\n- [PR checks](https://github.com/apache/fory/pull/4084/checks) on\n`8d13232090745f9371408904294bd252f3758e3b`: 62 passed, 15 conditionally\nskipped, no failures or pending checks.\n\n## AI Usage Disclosure\n\n- substantial_ai_assistance: yes\n- scope: CI diagnosis, workflow changes, and verification\n- affected_files_or_subsystems: `.github/workflows/ci.yml`\n- ai_review: Line-by-line self-review completed, followed by two fresh\nread-only reviewers; both reported no further actionable comments on\n`8d13232090745f9371408904294bd252f3758e3b`.\n- ai_review_artifacts: [Final reviewer\nreports](https://github.com/apache/fory/pull/4084) are preserved below\nin this PR description, with the reviewed commit and reviewer labels.\n- human_verification: Automated checks and their outcomes are listed\nabove; human verification is not asserted by the assistant.\n- performance_verification: Not applicable; workflow configuration only.\n- provenance_license_confirmation: No third-party source code\nintroduced; distribution migration follows official setup-java\ndocumentation.\n\n\u003cdetails\u003e\n\u003csummary\u003eFinal AI review evidence\u003c/summary\u003e\n\nBoth reviewers inspected commit\n`8d13232090745f9371408904294bd252f3758e3b` against\n`feeb8f5f23dbf26b21ba4328400e611170bee60f`.\n\n**Fory-guided read-only reviewer**\n\n\u003e no further actionable comments\n\u003e\n\u003e `semeru` is the official v6 replacement for `adopt-openj9`. The path\nfilter correctly enables OpenJ9 and the existing Java matrix for\nworkflow changes while preserving previous matches.\n\u003e\n\u003e Live CI remains the final validation; no tests or builds were run\nduring this review.\n\n**Independent general reviewer**\n\n\u003e No further actionable comments. The Semeru replacement follows\nsetup-java v6 guidance, and the updated path filter activates OpenJ9\ncoverage for workflow changes.\n\u003e\n\u003e Read-only review; no builds or tests run.\n\n\u003c/details\u003e"
    },
    {
      "commit": "feeb8f5f23dbf26b21ba4328400e611170bee60f",
      "tree": "d54db4cf5c9b0f81bb7de4cc6df4df4cfd8b6d93",
      "parents": [
        "3ca4473ac1fe25541c4e7a348754e21c5d7d9dd3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 27 17:25:27 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 27 17:25:27 2026 +0800"
      },
      "message": "ci: Bump the github-actions group with 15 updates (#4083)\n\nBumps the github-actions group with 15 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `3.1.0` |\n`7.0.1` |\n| [actions/upload-artifact](https://github.com/actions/upload-artifact)\n| `4` | `7` |\n| [actions/setup-python](https://github.com/actions/setup-python) |\n`4.1.0` | `7.0.0` |\n|\n[actions/download-artifact](https://github.com/actions/download-artifact)\n| `5` | `8` |\n| [actions/setup-java](https://github.com/actions/setup-java) | `4` |\n`6` |\n| [actions/cache](https://github.com/actions/cache) | `4` | `6` |\n| [gradle/actions/setup-gradle](https://github.com/gradle/actions) |\n`5.0.2` | `6.3.0` |\n| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4`\n| `6` |\n| [sbt/setup-sbt](https://github.com/sbt/setup-sbt) | `1.5.7` | `1.5.10`\n|\n| [dart-lang/setup-dart](https://github.com/dart-lang/setup-dart) |\n`1.7.2` | `1.8.1` |\n| [actions/setup-node](https://github.com/actions/setup-node) | `3` |\n`7` |\n| [actions/setup-go](https://github.com/actions/setup-go) | `4` | `7` |\n| [korandoru/hawkeye](https://github.com/korandoru/hawkeye) | `3` | `6`\n|\n|\n[amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request)\n| `5` | `6` |\n|\n[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish)\n| `1.13.0` | `1.14.2` |\n\nUpdates `actions/checkout` from 3.1.0 to 7.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eskip running unsafe pr check if input is default by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etrim only ascii whitespace for branch by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eescape values passed to --unset by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v7...v7.0.1\"\u003ehttps://github.com/actions/checkout/compare/v7...v7.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the\nminor-actions-dependencies group across 1 directory by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and\n\u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3\nupdates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003e[BREAKING]\u003c/strong\u003e backport\n\u003ccode\u003eallow-unsafe-pr-checkout\u003c/code\u003e to v6 by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2500\"\u003eactions/checkout#2500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebackport fixes to releases-v6 by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2527\"\u003eactions/checkout#2527\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\"\u003ehttps://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/\u003c/a\u003e\nfor more details about this breaking change\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v6.1.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID\nis set by \u003ca\nhref\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip running unsafe pr check if input is default by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2518\"\u003eactions/checkout#2518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTrim only ascii whitespace for branch by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2521\"\u003eactions/checkout#2521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape values passed to --unset by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2530\"\u003eactions/checkout#2530\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVarious dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements\nby \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca\nhref\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca\nhref\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca\nhref\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca\nhref\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca\nhref\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment\nvariables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca\nhref\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1\"\u003e\u003ccode\u003e3d3c42e\u003c/code\u003e\u003c/a\u003e\nprep v7.0.1 release (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2531\"\u003e#2531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07\"\u003e\u003ccode\u003e2880268\u003c/code\u003e\u003c/a\u003e\nescape values passed to --unset (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2530\"\u003e#2530\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1\"\u003e\u003ccode\u003e12cd223\u003c/code\u003e\u003c/a\u003e\ntrim only ascii whitespace for branch (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2521\"\u003e#2521\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541\"\u003e\u003ccode\u003e62661c4\u003c/code\u003e\u003c/a\u003e\nskip running unsafe pr check if input is default (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2518\"\u003e#2518\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f\"\u003e\u003ccode\u003ee8d4307\u003c/code\u003e\u003c/a\u003e\nBump the minor-actions-dependencies group with 2 updates (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2499\"\u003e#2499\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87\"\u003e\u003ccode\u003e631c942\u003c/code\u003e\u003c/a\u003e\neslint 9 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2474\"\u003e#2474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e\"\u003e\u003ccode\u003e4f1f4ae\u003c/code\u003e\u003c/a\u003e\nBump actions/upload-artifact from 4 to 7 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2476\"\u003e#2476\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92\"\u003e\u003ccode\u003eba09753\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 6 to 7 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2488\"\u003e#2488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22\"\u003e\u003ccode\u003eb9e0990\u003c/code\u003e\u003c/a\u003e\nBump docker/login-action from 3.3.0 to 4.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2479\"\u003e#2479\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2\"\u003e\u003ccode\u003ee8cb398\u003c/code\u003e\u003c/a\u003e\nBump docker/build-push-action from 6.5.0 to 7.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2478\"\u003e#2478\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v3.1.0...v7.0.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/upload-artifact` from 4 to 7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 What\u0027s new\u003c/h2\u003e\n\u003ch3\u003eDirect Uploads\u003c/h3\u003e\n\u003cp\u003eAdds support for uploading single files directly (unzipped). Callers\ncan set the new \u003ccode\u003earchive\u003c/code\u003e parameter to \u003ccode\u003efalse\u003c/code\u003e to\nskip zipping the file during upload. Right now, we only support single\nfiles. The action will fail if the glob passed resolves to multiple\nfiles. The \u003ccode\u003ename\u003c/code\u003e parameter is also ignored with this\nsetting. Instead, the name of the artifact will be the name of the\nuploaded file.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the \u003ccode\u003e@actions/*\u003c/code\u003e packages,\nwe\u0027ve upgraded the package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd proxy integration test by \u003ca\nhref\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade the module to ESM and bump dependencies by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/762\"\u003eactions/upload-artifact#762\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport direct file uploads by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/764\"\u003eactions/upload-artifact#764\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003ev6 - What\u0027s new\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nactions/upload-artifact@v6 now runs on Node.js 24 (\u003ccode\u003eruns.using:\nnode24\u003c/code\u003e) and requires a minimum Actions Runner version of 2.327.1.\nIf you are using self-hosted runners, ensure they are updated before\nupgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eNode.js 24\u003c/h3\u003e\n\u003cp\u003eThis release updates the runtime to Node.js 24. v5 had preliminary\nsupport for Node.js 24, however this action was by default still running\non Node.js 20. Now this action by default will run on Node.js 24.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpload Artifact Node 24 support by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/719\"\u003eactions/upload-artifact#719\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update \u003ccode\u003e@​actions/artifact\u003c/code\u003e for Node.js 24 punycode\ndeprecation by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/744\"\u003eactions/upload-artifact#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprepare release v6.0.0 for Node.js 24 support by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/745\"\u003eactions/upload-artifact#745\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBREAKING CHANGE:\u003c/strong\u003e this update supports Node\n\u003ccode\u003ev24.x\u003c/code\u003e. This is not a breaking change per-se but we\u0027re\ntreating it as such.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/GhadimiR\"\u003e\u003ccode\u003e@​GhadimiR\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/681\"\u003eactions/upload-artifact#681\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/712\"\u003eactions/upload-artifact#712\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: spell out the first use of GHES by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/727\"\u003eactions/upload-artifact#727\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate GHES guidance to include reference to Node 20 version by \u003ca\nhref\u003d\"https://github.com/patrikpolyak\"\u003e\u003ccode\u003e@​patrikpolyak\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/725\"\u003eactions/upload-artifact#725\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/artifact\u003c/code\u003e to \u003ccode\u003ev4.0.0\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ePrepare \u003ccode\u003ev5.0.0\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/pull/734\"\u003eactions/upload-artifact#734\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e\nfrom actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e\nInclude changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e\nReadme: bump all the example versions to v7 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e\nUpdate the readme with direct upload details (\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f\"\u003e\u003ccode\u003ebbbca2d\u003c/code\u003e\u003c/a\u003e\nSupport direct file uploads (\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296\"\u003e\u003ccode\u003e589182c\u003c/code\u003e\u003c/a\u003e\nUpgrade the module to ESM and bump dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5\"\u003e\u003ccode\u003e47309c9\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/754\"\u003e#754\u003c/a\u003e\nfrom actions/Link-/add-proxy-integration-tests\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0\"\u003e\u003ccode\u003e02a8460\u003c/code\u003e\u003c/a\u003e\nAdd proxy integration test\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f\"\u003e\u003ccode\u003eb7c566a\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/upload-artifact/issues/745\"\u003e#745\u003c/a\u003e\nfrom actions/upload-artifact-v6-release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b\"\u003e\u003ccode\u003ee516bc8\u003c/code\u003e\u003c/a\u003e\ndocs: correct description of Node.js 24 support in README\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/upload-artifact/compare/v4...v7\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-python` from 4.1.0 to 7.0.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1330\"\u003eactions/setup-python#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin SHA commits and update docs with latest versions by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1338\"\u003eactions/setup-python#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the pip-install input by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1336\"\u003eactions/setup-python#1336\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix to Classify stderr warning messages as warnings instead of\nerrors in annotations by \u003ca\nhref\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate and retry manifest fetch to prevent silent failures by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1332\"\u003eactions/setup-python#1332\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrade\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump certifi from 2020.6.20 to 2024.7.4 in\n/\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1328\"\u003eactions/setup-python#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove EOL Python versions and Bumps numpy text fixture by \u003ca\nhref\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1333\"\u003eactions/setup-python#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd RHEL support and include Linux distro in cache keys by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1323\"\u003eactions/setup-python#1323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix pip cache error handling on Windows by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1040\"\u003eactions/setup-python#1040\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade minimatch from 3.1.2 to 3.1.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1281\"\u003eactions/setup-python#1281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions dependencies by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write\ndenied by \u003ca\nhref\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependency versions and test workflow configuration by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1322\"\u003eactions/setup-python#1322\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate advanced-usage.md by \u003ca\nhref\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\"\u003ehttps://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade dependencies to Node 24 compatible versions by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1259\"\u003eactions/setup-python#1259\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003e\u003ccode\u003e5fda3b9\u003c/code\u003e\u003c/a\u003e\nPin SHA commits and update docs with latest versions (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e\"\u003e\u003ccode\u003e4ab7e95\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1337\"\u003e#1337\u003c/a\u003e\nfrom actions/philip-gai/bump-actions-cache-6-2-0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c\"\u003e\u003ccode\u003e0f3a009\u003c/code\u003e\u003c/a\u003e\nRemove the pip-install input (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1336\"\u003e#1336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932\"\u003e\u003ccode\u003ef8cf429\u003c/code\u003e\u003c/a\u003e\nMigrate to ESM and upgrade dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1330\"\u003e#1330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5\"\u003e\u003ccode\u003e54baeea\u003c/code\u003e\u003c/a\u003e\nValidate and retry manifest fetch to prevent silent failures (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1332\"\u003e#1332\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5\"\u003e\u003ccode\u003ec709277\u003c/code\u003e\u003c/a\u003e\nAnnotation code fix (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a\"\u003e\u003ccode\u003e6849080\u003c/code\u003e\u003c/a\u003e\nremove EOL Python versions and Bumps numpy text fixture (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1333\"\u003e#1333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e\"\u003e\u003ccode\u003e0903b46\u003c/code\u003e\u003c/a\u003e\nBump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1328\"\u003e#1328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1\"\u003e\u003ccode\u003eece7cb0\u003c/code\u003e\u003c/a\u003e\nFix pip cache error handling on Windows. (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1040\"\u003e#1040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf\"\u003e\u003ccode\u003e1d18d7a\u003c/code\u003e\u003c/a\u003e\nUpdate advanced-usage.md (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/811\"\u003e#811\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v4.1.0...v7.0.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/download-artifact` from 5 to 8\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.0\u003c/h2\u003e\n\u003ch2\u003ev8 - What\u0027s new\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nactions/download-artifact@v8 has been migrated to an ESM module. This\nshould be transparent to the caller but forks might need to make\nsignificant changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nHash mismatches will now error by default. Users can override this\nbehavior with a setting change (see below).\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eDirect downloads\u003c/h3\u003e\n\u003cp\u003eTo support direct uploads in \u003ccode\u003eactions/upload-artifact\u003c/code\u003e,\nthe action will no longer attempt to unzip all downloaded files.\nInstead, the action checks the \u003ccode\u003eContent-Type\u003c/code\u003e header ahead of\nunzipping and skips non-zipped files. Callers wishing to download a\nzipped file as-is can also set the new \u003ccode\u003eskip-decompress\u003c/code\u003e\nparameter to \u003ccode\u003etrue\u003c/code\u003e.\u003c/p\u003e\n\u003ch3\u003eEnforced checks (breaking)\u003c/h3\u003e\n\u003cp\u003eA previous release introduced digest checks on the download. If a\ndownload hash didn\u0027t match the expected hash from the server, the action\nwould log a warning. Callers can now configure the behavior on mismatch\nwith the \u003ccode\u003edigest-mismatch\u003c/code\u003e parameter. To be secure by\ndefault, we are now defaulting the behavior to \u003ccode\u003eerror\u003c/code\u003e which\nwill fail the workflow run.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the @actions/* packages, we\u0027ve upgraded\nthe package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDon\u0027t attempt to un-zip non-zipped downloads by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/460\"\u003eactions/download-artifact#460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd a setting to specify what to do on hash mismatch and default it\nto \u003ccode\u003eerror\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/461\"\u003eactions/download-artifact#461\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/compare/v7...v8.0.0\"\u003ehttps://github.com/actions/download-artifact/compare/v7...v8.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 - What\u0027s new\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nactions/download-artifact@v7 now runs on Node.js 24 (\u003ccode\u003eruns.using:\nnode24\u003c/code\u003e) and requires a minimum Actions Runner version of 2.327.1.\nIf you are using self-hosted runners, ensure they are updated before\nupgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eNode.js 24\u003c/h3\u003e\n\u003cp\u003eThis release updates the runtime to Node.js 24. v6 had preliminary\nsupport for Node 24, however this action was by default still running on\nNode.js 20. Now this action by default will run on Node.js 24.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate GHES guidance to include reference to Node 20 version by \u003ca\nhref\u003d\"https://github.com/patrikpolyak\"\u003e\u003ccode\u003e@​patrikpolyak\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/440\"\u003eactions/download-artifact#440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDownload Artifact Node24 support by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/415\"\u003eactions/download-artifact#415\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update \u003ccode\u003e@​actions/artifact\u003c/code\u003e to fix Node.js 24\npunycode deprecation by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/451\"\u003eactions/download-artifact#451\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprepare release v7.0.0 for Node.js 24 support by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/452\"\u003eactions/download-artifact#452\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/patrikpolyak\"\u003e\u003ccode\u003e@​patrikpolyak\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/440\"\u003eactions/download-artifact#440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/415\"\u003eactions/download-artifact#415\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0\"\u003ehttps://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\"\u003e\u003ccode\u003e3e5f45b\u003c/code\u003e\u003c/a\u003e\nAdd regression tests for CJK characters (\u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/471\"\u003e#471\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd\"\u003e\u003ccode\u003ee6d03f6\u003c/code\u003e\u003c/a\u003e\nAdd a regression test for artifact name + content-type mismatches (\u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/472\"\u003e#472\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3\"\u003e\u003ccode\u003e70fc10c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/461\"\u003e#461\u003c/a\u003e\nfrom actions/danwkennedy/digest-mismatch-behavior\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62\"\u003e\u003ccode\u003ef258da9\u003c/code\u003e\u003c/a\u003e\nAdd change docs\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c\"\u003e\u003ccode\u003eccc058e\u003c/code\u003e\u003c/a\u003e\nFix linting issues\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd\"\u003e\u003ccode\u003ebd7976b\u003c/code\u003e\u003c/a\u003e\nAdd a setting to specify what to do on hash mismatch and default it to\n\u003ccode\u003eerror\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c\"\u003e\u003ccode\u003eac21fcf\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/460\"\u003e#460\u003c/a\u003e\nfrom actions/danwkennedy/download-no-unzip\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0\"\u003e\u003ccode\u003e15999bf\u003c/code\u003e\u003c/a\u003e\nAdd note about package bumps\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561\"\u003e\u003ccode\u003e974686e\u003c/code\u003e\u003c/a\u003e\nBump the version to \u003ccode\u003ev8\u003c/code\u003e and add release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75\"\u003e\u003ccode\u003efbe48b1\u003c/code\u003e\u003c/a\u003e\nUpdate test names to make it clearer what they do\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/compare/v5...v8\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/setup-java` from 4 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edist: Migrate from Zulu Discovery API to Azul Metadata API by \u003ca\nhref\u003d\"https://github.com/jameswald\"\u003e\u003ccode\u003e@​jameswald\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1010\"\u003eactions/setup-java#1010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add .mvn/extensions.xml to Maven cache key pattern by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1041\"\u003eactions/setup-java#1041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1078\"\u003eactions/setup-java#1078\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMap Zulu x86 architecture to i686 for Azul Metadata API by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1079\"\u003eactions/setup-java#1079\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRename jdkFile input to jdk-file with deprecated alias by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1083\"\u003eactions/setup-java#1083\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInfer distribution from asdf .tool-versions vendor prefix by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1084\"\u003eactions/setup-java#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Maven compiler problem matcher for javac diagnostics by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1086\"\u003eactions/setup-java#1086\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: expose cache-primary-key output (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/597\"\u003e#597\u003c/a\u003e)\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1088\"\u003eactions/setup-java#1088\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify V6 ESM migration is not a user-facing breaking change\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1090\"\u003eactions/setup-java#1090\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport multi-field Java versions like \u003ccode\u003e18.0.1.1\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1092\"\u003eactions/setup-java#1092\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document seeding the Maven cache for plugin dependencies by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1094\"\u003eactions/setup-java#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify Maven cache paths and key hash inputs by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1096\"\u003eactions/setup-java#1096\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport pinning java-version as \u0026quot;latest\u0026quot; by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1093\"\u003eactions/setup-java#1093\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1101\"\u003eactions/setup-java#1101\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1103\"\u003eactions/setup-java#1103\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1105\"\u003eactions/setup-java#1105\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/checkout from 6 to 7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1106\"\u003eactions/setup-java#1106\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.1.0 to\n26.1.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1104\"\u003eactions/setup-java#1104\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Cover Tencent Kona JDK 25 by \u003ca\nhref\u003d\"https://github.com/johnshajiang\"\u003e\u003ccode\u003e@​johnshajiang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1108\"\u003eactions/setup-java#1108\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1102\"\u003eactions/setup-java#1102\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve Maven toolchains across repeated setup-java runs (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1099\"\u003e#1099\u003c/a\u003e)\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1111\"\u003eactions/setup-java#1111\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Support Liberica NIK (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/878\"\u003e#878\u003c/a\u003e)\nby \u003ca href\u003d\"https://github.com/asm0dey\"\u003e\u003ccode\u003e@​asm0dey\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1112\"\u003eactions/setup-java#1112\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection (zizmor alert \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/118\"\u003e#118\u003c/a\u003e)\nin e2e-versions.yml by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1114\"\u003eactions/setup-java#1114\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection in e2e-versions.yml (zizmor alert \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/122\"\u003e#122\u003c/a\u003e)\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1120\"\u003eactions/setup-java#1120\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDisable persisted checkout credentials in e2e workflow by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1115\"\u003eactions/setup-java#1115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: Update recommended configuration for GPG signing by \u003ca\nhref\u003d\"https://github.com/wetneb\"\u003e\u003ccode\u003e@​wetneb\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/608\"\u003eactions/setup-java#608\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCache Maven and Gradle wrapper distributions separately from the\ndependency cache by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1097\"\u003eactions/setup-java#1097\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate cache-dependency-path e2e workflow and add maven/sbt\ncoverage by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1124\"\u003eactions/setup-java#1124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse gpg.passphraseEnvName instead of the deprecated gpg.passphrase\nserver by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1123\"\u003eactions/setup-java#1123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExtract repeated directory-check assertions into check-dir.sh helper\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1127\"\u003eactions/setup-java#1127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate duplicate jobs in e2e-versions workflow by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1125\"\u003eactions/setup-java#1125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse YAML anchors to reduce boilerplate in e2e-versions workflow by\n\u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1126\"\u003eactions/setup-java#1126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdated msft json for now by \u003ca\nhref\u003d\"https://github.com/jmjaffe37\"\u003e\u003ccode\u003e@​jmjaffe37\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1129\"\u003eactions/setup-java#1129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument missing action inputs in README by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1130\"\u003eactions/setup-java#1130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1128\"\u003eactions/setup-java#1128\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd an option to disable Java problem matchers by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1133\"\u003eactions/setup-java#1133\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update setup-java examples by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1131\"\u003eactions/setup-java#1131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify credential environment variable inputs by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1134\"\u003eactions/setup-java#1134\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/eslint-plugin\u003c/code\u003e\nfrom 8.63.0 to 8.64.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1135\"\u003eactions/setup-java#1135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/setup-python from 6 to 7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1143\"\u003eactions/setup-java#1143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1142\"\u003eactions/setup-java#1142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from\n8.64.0 to 8.65.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1138\"\u003eactions/setup-java#1138\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1136\"\u003eactions/setup-java#1136\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1137\"\u003eactions/setup-java#1137\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): fix npm audited vulnerabilities by \u003ca\nhref\u003d\"https://github.com/mhoffrog\"\u003e\u003ccode\u003e@​mhoffrog\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1140\"\u003eactions/setup-java#1140\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix formatting issues in README.md by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1144\"\u003eactions/setup-java#1144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemediate npm audit findings and rebuild distributions by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1145\"\u003eactions/setup-java#1145\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSet GRAALVM_HOME for GraalVM distributions by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1146\"\u003eactions/setup-java#1146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/de7274f081f381c8f8158605e0321c36c376e2e6\"\u003e\u003ccode\u003ede7274f\u003c/code\u003e\u003c/a\u003e\nAvoid macOS GPG socket overflow on long runner paths (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1266\"\u003e#1266\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/134912a529122c8803d42fbefc4adb2bd177f986\"\u003e\u003ccode\u003e134912a\u003c/code\u003e\u003c/a\u003e\nFix import-safe checks when scripts are run from a path with symlinks\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1265\"\u003e#1265\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/0781fc6af30d3e1f67f2d243034e1a15cf5f3677\"\u003e\u003ccode\u003e0781fc6\u003c/code\u003e\u003c/a\u003e\nFix alpine failures by switching default back to only warn on\nverification fa...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/4889c4aff54cecfc8d479c505d9893fd814df73f\"\u003e\u003ccode\u003e4889c4a\u003c/code\u003e\u003c/a\u003e\nFix Temurin EA E2E signature verification (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1260\"\u003e#1260\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/8fd32400856216412ac77ad6dc67cca66ecffb93\"\u003e\u003ccode\u003e8fd3240\u003c/code\u003e\u003c/a\u003e\n[WIP] Fix failing GitHub Actions job for temurin 17 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1259\"\u003e#1259\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/273229181560643261a71a1544c22304f2a40df8\"\u003e\u003ccode\u003e2732291\u003c/code\u003e\u003c/a\u003e\nchore(deps-dev): update eslint and globals (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1256\"\u003e#1256\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/1a8f22b7f7b115efae2d0dbe944753d561a53801\"\u003e\u003ccode\u003e1a8f22b\u003c/code\u003e\u003c/a\u003e\nchore: streamline Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1255\"\u003e#1255\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/85030b78b58b52f56c1ed3d0e893d2c93117274b\"\u003e\u003ccode\u003e85030b7\u003c/code\u003e\u003c/a\u003e\ndocs: complete v6 release highlights (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1254\"\u003e#1254\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/dd06d9cba3e5552c54d9f8ea23572deb30010f7c\"\u003e\u003ccode\u003edd06d9c\u003c/code\u003e\u003c/a\u003e\nPrepare documentation for v6 release (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1253\"\u003e#1253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/59b3450628e54f250d3a3bfd413cd68b83bce8ed\"\u003e\u003ccode\u003e59b3450\u003c/code\u003e\u003c/a\u003e\nchore(deps): combine open Dependabot npm updates (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1252\"\u003e#1252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/setup-java/compare/v4...v6\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `actions/cache` from 4 to 6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate packages, migrate to ESM by \u003ca\nhref\u003d\"https://github.com/Samirat\"\u003e\u003ccode\u003e@​Samirat\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1760\"\u003eactions/cache#1760\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/cache/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v5.1.0 - handle read-only cache\naccess by \u003ca\nhref\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1775\"\u003eactions/cache#1775\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v5...v5.1.0\"\u003ehttps://github.com/actions/cache/compare/v5...v5.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.5\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate ts-http-runtime dependency by \u003ca\nhref\u003d\"https://github.com/yacaovsnc\"\u003e\u003ccode\u003e@​yacaovsnc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1747\"\u003eactions/cache#1747\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v5...v5.0.5\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.4\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd release instructions and update maintainer docs by \u003ca\nhref\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1696\"\u003eactions/cache#1696\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePotential fix for code scanning alert no. 52: Workflow does not\ncontain permissions by \u003ca\nhref\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1697\"\u003eactions/cache#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix workflow permissions and cleanup workflow names / formatting by\n\u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1699\"\u003eactions/cache#1699\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update examples to use the latest version by \u003ca\nhref\u003d\"https://github.com/XZTDean\"\u003e\u003ccode\u003e@​XZTDean\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1690\"\u003eactions/cache#1690\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix proxy integration tests by \u003ca\nhref\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1701\"\u003eactions/cache#1701\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix cache key in examples.md for bun.lock by \u003ca\nhref\u003d\"https://github.com/RyPeck\"\u003e\u003ccode\u003e@​RyPeck\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1722\"\u003eactions/cache#1722\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies \u0026amp; patch security vulnerabilities by \u003ca\nhref\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e@​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1738\"\u003eactions/cache#1738\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/XZTDean\"\u003e\u003ccode\u003e@​XZTDean\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1690\"\u003eactions/cache#1690\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/RyPeck\"\u003e\u003ccode\u003e@​RyPeck\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/pull/1722\"\u003eactions/cache#1722\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v5...v5.0.4\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca\nhref\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v5...v5.0.3\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev.5.0.2\u003c/h2\u003e\n\u003ch1\u003ev5.0.2\u003c/h1\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e\nwith the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e\nsection.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by\nupdating the \u003ca\nhref\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e\nfile with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed\nand merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca\nhref\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e\nuse the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you\nmade in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca\nhref\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version\nnumber.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags\nfor this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca\nhref\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435\nHandle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log\nin save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003e@actions/cache\u003c/code\u003e to ^6.0.1,\n\u003ccode\u003e@actions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003e@actions/exec\u003c/code\u003e to\n^3.0.0, \u003ccode\u003e@actions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM\ncompatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar\npatterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb\nprotection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca\nhref\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@actions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003e\u003ccode\u003e55cc834\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/issues/1768\"\u003e#1768\u003c/a\u003e\nfrom jasongin/readonly-cache\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337\"\u003e\u003ccode\u003ed8cd72f\u003c/code\u003e\u003c/a\u003e\nBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to v6.1.0 - handle cache write error\ndue to RO token\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8\"\u003e\u003ccode\u003e2c8a9bd\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/cache/issues/1760\"\u003e#1760\u003c/a\u003e\nfrom actions/samirat/esm_migration_and_package_update\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023\"\u003e\u003ccode\u003ee9b91fd\u003c/code\u003e\u003c/a\u003e\nPrettier fixes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb\"\u003e\u003ccode\u003ee4884b8\u003c/code\u003e\u003c/a\u003e\nRebuild dist\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f\"\u003e\u003ccode\u003e10baf01\u003c/code\u003e\u003c/a\u003e\nFixed licenses\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37\"\u003e\u003ccode\u003ee39b386\u003c/code\u003e\u003c/a\u003e\nFix test mock return order\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06\"\u003e\u003ccode\u003eb692820\u003c/code\u003e\u003c/a\u003e\nPR feedback\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1\"\u003e\u003ccode\u003e6074912\u003c/code\u003e\u003c/a\u003e\nRebuild dist bundles as ESM to match type:module\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e\"\u003e\u003ccode\u003e5a912e8\u003c/code\u003e\u003c/a\u003e\nFix lint and jest issues\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/cache/compare/v4...v6\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gradle/actions/setup-gradle` from 5.0.2 to 6.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/gradle/actions/releases\"\u003egradle/actions/setup-gradle\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eHighlights\u003c/h2\u003e\n\u003ch3\u003eEnhanced Caching: Windows fixes and a cache-protocol bump\u003c/h3\u003e\n\u003cp\u003eThis release updates \u003ccode\u003egradle-actions-caching\u003c/code\u003e to\n\u003cstrong\u003ev1.0.0\u003c/strong\u003e (up from v0.7.0), which fixes two significant\ncaching defects, both most visible on Windows:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCache entries failed to store at all on Windows.\u003c/strong\u003e.\nEvery entry failed\nwith \u003ccode\u003ePath Validation Error: Path(s) specified in the action for\ncaching do(es) not exist\u003c/code\u003e, even though the Gradle User Home was\nfully intact. Nothing was stored, so\nevery downstream job ran against an empty Gradle User Home. The cause\nwas a nested,\nunpatched copy of \u003ccode\u003e@actions/glob\u003c/code\u003e combined with a silently\nswallowed \u003ccode\u003erequire()\u003c/code\u003e in\nthe bundle, which left Windows path separators unnormalized.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCache cleanup deleted instrumented jars that were in\nuse.\u003c/strong\u003e A bug in key\nhashing for paths shorter than 64 characters made cleanup ...\n\n_Description has been truncated_\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "3ca4473ac1fe25541c4e7a348754e21c5d7d9dd3",
      "tree": "afa66c309076a92dda89089fd899511691772584",
      "parents": [
        "9043ae6503138ce4ebc28aaf05baed50ccbd7986"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 27 17:01:46 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 27 17:01:46 2026 +0800"
      },
      "message": "ci: update GraalVM action and enable Dependabot (#4082)\n\n## Why?\n\nThe [ASF allowlist\njob](https://github.com/apache/fory/actions/runs/36290519259/job/108539571389)\nfails because the three\n`graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38`\nreferences are no longer allowlisted.\n\n## What does this PR do?\n\n- Update all three GraalVM setup references to the ASF-approved v1.6.6\ncommit `0426e2e191540e8514dff98dc52a5f5146a2a276`.\n- Add Dependabot for GitHub Actions, following\n[apache/kvrocks#3612](https://github.com/apache/kvrocks/pull/3612):\nweekly grouped version updates, a four-day cooldown, separate\nsecurity-update grouping, and the `ci` commit prefix.\n\n## Validation\n\n- Run the exact ASF checker used by the failing job against a frozen\ncurrent allowlist: the baseline reproduces all three rejections; this\nchange passes with all 30 unique action references approved.\n- Yamllint passes across all 46 YAML files, with existing\ncomment-spacing warnings only.\n- Dependabot schema validation, Prettier checks for both changed files,\nand `git diff --check` pass.\n- Both fresh reviewers report no actionable findings. [Review results\nand validation\nevidence](https://gist.github.com/chaokunyang/65d9191831e5955390ed8d00530bed7d).\n\n## AI Usage Disclosure\n\n- substantial_ai_assistance: yes\n- scope: CI diagnosis, configuration changes, local validation, and\nreview\n- affected_files_or_subsystems: `.github/workflows/ci.yml` and\n`.github/dependabot.yml`\n- ai_review: assistant line-by-line self-review completed, followed by\nfresh Fory-guided and independent general reviewers; both reported no\nactionable findings on the final patch in\n`1bf4b7ce380749785274f5154d9b46b22fa0ce74`\n- ai_review_artifacts: [Fory-guided and independent review\nresults](https://gist.github.com/chaokunyang/65d9191831e5955390ed8d00530bed7d)\n- human_verification: the checks above were executed and their results\nreviewed by the assistant; human contributor verification is not\nasserted by this automated record\n- performance_verification: not applicable; CI configuration only\n- provenance_license_confirmation: Dependabot configuration follows the\nApache-licensed Kvrocks reference and preserves its ASF license header;\nno runtime or third-party code is introduced\n\n## AI Contribution Checklist\n\n- [x] Substantial AI assistance was used: yes.\n- [x] Scope, affected files, validation, provenance, and review evidence\nare disclosed above.\n- [x] Assistant self-review completed before the two fresh reviews.\n- [x] A fresh Fory-guided reviewer followed `AGENTS.md` and\n`.agents/ci-and-pr.md`.\n- [x] A separate fresh independent reviewer did not use the\nFory-specific review guide.\n- [x] Both reviewers reported no further actionable comments on the\nfinal patch; their results are linked above.\n- [x] Relevant local checks passed and are recorded above.\n- [x] No public API, binary protocol, runtime behavior, or performance\nchange requires additional runtime tests or benchmarks.\n- [x] Apache-2.0-compatible configuration provenance and the required\nlicense header are preserved.\n- [ ] Human contributor has personally reviewed the patch and validation\nresults, can explain the change, and confirms submission accountability."
    },
    {
      "commit": "9043ae6503138ce4ebc28aaf05baed50ccbd7986",
      "tree": "95984df62cc2bbdabaaee82def03eeec75fec02f",
      "parents": [
        "a56d0dd168f8b8bcc8c6535e9be7da8ddff64753"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 27 11:07:52 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 27 11:07:52 2026 +0800"
      },
      "message": "docs: update release version to 1.7.5 (#4080)\n\nUpdate user-facing installation examples and release references to\nApache Fory 1.7.5. Add the Dart 1.7.5 changelog entries while retaining\nthe existing 1.8.0 development versions.\n\nValidation: reviewed the version-only diff, formatted changed Markdown\nwith Prettier, checked for stale 1.7.4 references, and passed `git diff\n--check`. No local builds or tests were run for this documentation-only\nupdate."
    },
    {
      "commit": "a56d0dd168f8b8bcc8c6535e9be7da8ddff64753",
      "tree": "aed6a928400e94a2456e821b1b26c1525e2d2133",
      "parents": [
        "d15f7af104521a11509362a2d0e151c1163698ad"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 23 10:29:36 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 23 07:59:36 2026 +0530"
      },
      "message": "feat(json): configure missing required constructor properties (#4079)\n\n## Why?\n\nMissing ordinary constructor properties currently receive type fallbacks\nsuch as zero, false, or null. Applications need an opt-in way to reject\nincomplete input while retaining declared language defaults and existing\noptional/container recovery.\n\n## What does this PR do?\n\nAdds `ForyJson.builder().failOnMissingRequiredProperties(true)`,\ndisabled by default. It applies to Java records and property-based\ncreators, Scala case classes, and Kotlin constructor models, including\nnested objects. Declared defaults remain usable; explicit null, ignored\nproperties, and ordinary no-argument beans retain their existing rules.\n\nThe implementation reuses creator presence tracking and missing-argument\nresolution in interpreted, generated, and annotation-processor paths.\nReader cache keys distinguish the setting; writer keys remain unchanged.\nBuilder Javadoc and Java/Scala/Kotlin guides document the behavior.\n\n## Validation\n\n- Java JSON: 102 focused tests passed, including controlled asynchronous\nreader replacement.\n- Java annotation processor: 73 tests passed, including compilation and\nexecution of a generated record codec with a Mixin.\n- Scala 2.13 and 3.3.8: 79 JSON tests passed for each version.\n- Kotlin JSON: 12 tests passed; KSP: 10 resource and retention-rule\ntests passed.\n- Checkstyle, Spotless, and Markdown formatting passed.\n\nValidated on macOS arm64 with OpenJDK 26.0.1. Native-image and\nAndroid/R8 end-to-end tests and benchmarks were not run.\n\n## Does this PR introduce any user-facing change?\n\n- [x] Adds an opt-in JSON builder API; default behavior is unchanged.\n- [ ] Changes the binary serialization protocol."
    },
    {
      "commit": "d15f7af104521a11509362a2d0e151c1163698ad",
      "tree": "d2e3d002ede9edb90d0ec712e41f51e1e9e8f8d7",
      "parents": [
        "acdcade52b4a22b22734430e66b0e1d84f8dac8e"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 23 09:33:58 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 23 07:03:58 2026 +0530"
      },
      "message": "fix(json): retain properties without defaults under NON_DEFAULT (#4078)\n\n## Why?\n\n`NON_DEFAULT` rejected properties without defaults, so a Scala model\nsuch as `@JsonInclude(NON_DEFAULT) case class Request(id: String,\nretries: Int \u003d 3)` could not serialize without an `ALWAYS` override on\n`id`. Java parameterized creators and Kotlin required parameters had the\nsame problem.\n\n## What does this PR do?\n\nKeep properties without defaults in the output under both class-level\n`@JsonInclude(NON_DEFAULT)` and field-level `@JsonProperty(include \u003d\nNON_DEFAULT)`, including null, zero, false and empty values. Apply the\ndecision in the existing codec initialization path; per-write omission\nand generated code remain unchanged.\n\n- Scala keeps properties without a supported compiler default method and\ncontinues comparing declared defaults using the current object\u0027s actual\ndependencies.\n- Java keeps authorized properties when the selected read path has no\nno-argument reference constructor. An unrelated no-argument constructor\ndoes not replace the selected creator.\n- Kotlin keeps required constructor properties and uninitialized\n`lateinit` properties in the write schema. Defaulted properties still\nrequire a legal all-default reference construction path; required\narguments are never fabricated.\n- Preserve failures from selected default methods, unavailable\ndependencies, and reference construction. Keep global `NON_DEFAULT`\nrejection.\n- Update annotation Javadocs and JSON guides, and cover Mixin and\ngenerated/non-generated paths.\n\n## Validation\n\nOpenJDK 25.0.3:\n\n- Java: `JsonInclusionTest` (30 tests) and `JsonTypeProcessorTest` (73\ntests), including actual compilation and use of generated codecs.\n- Scala: `ScalaJsonSuite`, 78 tests each on Scala 2.13.18 and 3.3.8.\n- Kotlin: `KotlinDefaultArgumentsTest` (4 tests), including String/UTF-8\nand compact/pretty output with codegen on/off.\n- Kotlin KSP: `R8RulesWriterTest` and `ProcessorResourceTest` (10\ntests). Existing retention paths need no production changes. These\nresource tests are not Android/native-image end-to-end validation.\n- Java Spotless/Checkstyle, Kotlin Spotless, Markdown formatting and\n`git diff --check` passed.\n\nNo GraalVM or benchmarks were run.\n\n## Does this PR introduce any user-facing change?\n\nProperties without defaults no longer cause an error under class-level\nor field-level `NON_DEFAULT`; their values are serialized. No public API\nadditions or binary protocol changes."
    },
    {
      "commit": "acdcade52b4a22b22734430e66b0e1d84f8dac8e",
      "tree": "60c12517093fe9b48564baa65b89ffe638695933",
      "parents": [
        "e1052ef934a17c8e89bcca9f30e89282cdd5efb6"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Sep 22 09:01:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 06:31:09 2026 +0530"
      },
      "message": "fix: decode remote schemas without caching after quota exhaustion (#4076)\n\nWhen remote schema caches reach their per-type, average-version, or\nlogical-type limits, valid new schemas currently fail to deserialize.\nTreat those limits as retention limits across C++, C#, Dart, Go, Java,\nJavaScript, Python/Cython, Rust, and Swift: fully validate and decode\noverflow schemas without adding persistent metadata or derived\nserializer/layout entries. Existing cached and local-schema hits keep\ntheir fast paths. Reusable metadata slots retain their existing logical\nreset behavior; bounded stale backing references do not require\nimmediate physical clearing.\n\nAlso advance Java MetaString reference IDs only after insertion\nsucceeds, so exceeding the reference limit cannot break root cleanup and\nlater instance reuse.\n\nValidation:\n\n- Runtime regression tests cover uncached overflow, bounded cache\naccounting, and cleanup/reuse; Java tests cover native/xlang and codegen\non/off.\n- C++ focused serialization tests, Go tests, Rust tests/clippy, C#\ntests, Swift tests, Dart tests/analyzer, Java core/focused tests,\nJavaScript tests, and Python/Cython tests passed. Root-operation tests\ncover overflow values, repeated metadata references, failure cleanup,\nbounded cache growth, and instance reuse.\n- Java-driven cross-language matrix: 806 tests, no failures/errors, 24\nskips. Separate Cython-to-Java validation: 103 tests, no\nfailures/errors, 20 skips.\n- After restoring metadata slot reuse: Java 184 focused tests, Go full\nsuite, C# 377 tests, JavaScript 387 tests/1 skip plus 16 schema-limit\ntests, and Swift 281 tests passed. Revision `7490abf2ad` passed the full\n806-test Java-driven cross-language matrix (24 skips, no\nfailures/errors) and GraalVM 25 ObjectStream native image\nbuild/execution. The subsequent C++/Go hot-path reset repair passed both\nC++ serialization targets and focused Go overflow/reuse tests; it\nrestores existing C++ field offsets and reuses the existing metadata\ncleanup branch.\n- Subsequent Rust dispatch changes passed 859 tests (71 ignored),\nall-target/all-feature clippy, and 16 focused root/struct tests for the\nfinal combination. Only local compiler-produced TypeId maps use the\nspecialized hasher; wire-derived keys retain their existing hashers.\nDart\u0027s reset inline hint and removal of redundant root null dispatch\npassed 14 object/compatible/runtime-binding tests, analyzer, and AOT\nbuilds in both modes.\n- NumericStruct and MediaContent comparisons cover all nine modified\nruntimes, serialization/deserialization, and\nschema-consistent/compatible modes against `99fd6b3a4`.\nFinal-source-equivalent coverage is 72/72 cases, with 254 retained\nadjacent pairs. All case median throughput deltas are within the 1%\nregression threshold: worst -0.981%, best +23.830%. Compatible Java\nNumericStruct/MediaContent deserialize are +0.10%/-0.88%; Rust\nNumericStruct deserialize is +23.83%; Dart NumericStruct/MediaContent\nserialize are +0.96%/+0.36%. Measurements ran serially on an Apple M4\nPro, with identical workloads and balanced-order follow-ups. Every valid\nobservation for the final implementation is retained; older\nimplementations are kept separately. Individual pairs and same-binary\ncontrols vary by more than 1%, so these medians are measured results\nrather than statistical confidence bounds."
    },
    {
      "commit": "e1052ef934a17c8e89bcca9f30e89282cdd5efb6",
      "tree": "451b94f0f639223913150a1c3f34df05d8103dde",
      "parents": [
        "99fd6b3a4d23ca78f99070d3fe8555bb8fa48afa"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Sep 22 00:53:27 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 22:23:27 2026 +0530"
      },
      "message": "feat(json): support non-ASCII escaping (#4077)\n\n## What does this PR do?\n\nAdds instance-level `ForyJson.builder().escapeNonAscii(true)` for String\nand UTF-8 output. The default remains false. Structured string values,\nproperty names, map keys, enum names and subtype identifiers use\nlowercase Unicode escapes, including surrogate pairs for supplementary\ncharacters. Raw JSON keeps its original representation, and pretty\noutput remains selected per call.\n\nThe writers batch UTF-16 conversion with a fixed, lazily initialized\nlookup table shared across instances. Generated writer metadata includes\nthe escape policy. This also fixes subtype-name hashing when a Latin1\ninput contains escaped non-Latin1 characters.\n\n## How was this PR tested?\n\n- Java JSON suite: 1,230 tests passed before the final writer\noptimization; focused String/subtype tests and the annotation\nprocessor\u0027s compiled Mixin pipeline passed again with the final\nimplementation.\n- Scala 2/3, Scala 3 derived enums, Kotlin and existing KSP output tests\npassed.\n- Coverage includes String/UTF-8, generated/interpreted codecs,\ncompact/pretty, malformed surrogate recovery, Mixin/unwrapped fields and\nraw JSON.\n- The native-image fixture compiles; local native-image execution was\nnot run.\n- The unchanged jsoniter-scala escaped-string fixture passes with the\nnew Fory adapter under Scala 2 and Scala 3. Final paired performance and\ndefault-output regression measurements are in progress and will be added\nto this PR.\n\n## Does this PR introduce any user-facing change?\n\nAn opt-in builder setting, documented in the JSON mapping, custom codec,\nScala, Kotlin and native-image guides. Existing output is unchanged when\nthe setting is disabled."
    },
    {
      "commit": "99fd6b3a4d23ca78f99070d3fe8555bb8fa48afa",
      "tree": "00a6155103981c307d14239f5f3e9ef44dd81ad6",
      "parents": [
        "217cdec4a44781b1e096bd0651a8879983b6dfae"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 21 21:34:41 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 19:04:41 2026 +0530"
      },
      "message": "feat(json): add global byte array formats and Base16 support (#4075)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "217cdec4a44781b1e096bd0651a8879983b6dfae",
      "tree": "78ef603beff90cf6eec644a6bef1045afc228319",
      "parents": [
        "2144dd32e6a750a245f39059afcae922182e118a"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 21 19:24:31 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 16:54:31 2026 +0530"
      },
      "message": "feat(json): add explicit default omission and Scala empty inclusion (#4074)\n\n## Why?\n\nEmpty-value filtering should recognize Scala `None` and supported strict\ncollections. Default-value omission needs explicit authorization because\ndefaults can depend on other parameters or external state. For example,\nwhen `high` defaults to `low + 1`, an object with `low\u003d5, high\u003d2` must\nretain `high`; omitting it against an all-default reference value of 2\nwould restore 6 when reading.\n\n## What does this PR do?\n\n- Add field-level `@JsonProperty(include \u003d NON_DEFAULT)` and class-level\n`@JsonInclude(NON_DEFAULT)`, including Mixin support. Field policies\ntake precedence; `ALWAYS` opts out. Reject global `NON_DEFAULT`.\n- Evaluate Scala declared compiler defaults using the current object\u0027s\nactual dependency values. Keep reader type fallbacks distinct and reject\nunsupported sources, including class-body initializers and missing\ndependencies.\n- For authorized Java no-argument models and Kotlin models whose\nselected constructor has defaults for every parameter, initialize one\nreference object per model metadata and retain the authorized comparison\nvalues. Reject required parameters, incompatible alternate constructors,\nand construction failures. Reading keeps its normal construction path\nand never shares mutable reference defaults.\n- Preserve primitive comparisons, reference `equals`, array-content\ncomparisons, and selected codecs\u0027 retained-null behavior across\ngenerated/interpreted String and UTF-8 writers, including compact,\npretty, and write-only unwrapped groups.\n- Add `JsonValueCodec.isEmpty(JsonWriter, T)`, defaulting to false.\nBuilt-in Java empty types use direct checks; other types use their\nselected codec. Scala Option, strict collections/maps, BitSet and ranges\nimplement the hook. Custom codecs must override it to define their own\nempty values. Filtering remains shallow.\n- Make `NaturalCodec` resolver-local and share its one-slot runtime-type\ncache between emptiness checks and writing. Cache `JsonTypeInfo` so\ngenerated writer updates remain visible, clear it on resolution\nrollback, and retain scalar Mixin behavior and Scala Boolean fast paths.\n- Document authorization, evaluation and construction effects,\ndynamic/dependent default boundaries, unsupported models, Mixin\nexamples, and class authorization covering future fields. Remove\nobsolete reflected emptiness/default-factory paths and duplicate writer\nconstruction logic.\n\nThe Java annotation processor recognizes `JsonInclude` on Mixins.\nExisting generated accessors/creator operations and Kotlin KSP retention\ncover the new paths. Tests compile and use Java generated output and\ninspect actual KSP-produced resources. No default-expression analysis or\nKotlin compiler plugin is added.\n\n## Validation\n\nFocused verification of the revised implementation used OpenJDK 25.0.3:\n\n| Verification | Result |\n| --- | --- |\n| Complete `fory-json` suite at `af98c0f66` | 1,211 passed |\n| Java processor compiled-output default-inclusion test | 1 passed |\n| Scala 2.13.18 / 3.3.8 omission and Unit field tests after final fixes\n| 6 passed on each version |\n| Kotlin defaults, nullability and Pair/Triple tests | 16 passed |\n| Java Checkstyle and Java/Kotlin Spotless | Passed |\n\nThe cache regression counts one resolver lookup across `isEmpty` and all\nfour output APIs, checks type switching and rollback, and verifies\nresolver isolation. It does not measure throughput. Generated-path tests\ncheck installed writer capabilities. Final regressions cover Scala\ndependency getters whose names are Java keywords and Kotlin reference\nconstruction with unrelated required `lateinit` properties. Missing\n`lateinit` input remains an error. Before these final fixes, the Scala\nomission and Boolean collection tests passed all 10 cases on each\nversion.\n\nThe complete JSON suite includes the scalar-format regression that\nexposed an undeclared writer reference after generated-method splitting.\nEmptiness checks now use the caller\u0027s writer expression so splitting\ncaptures and renames it correctly.\n\nEarlier validation at `685bada19` also passed the actual KSP\nresource/JVM corpus tests (3) and packaged-artifact inventory check. No\nKSP or retention-rule implementation changed afterward.\nGraalVM/native-image and Android end-to-end tests were not run locally;\nremote CI results are reported separately. Scala `Unit` defaults whose\nJVM methods return `void` remain unsupported comparison sources and fail\nexplicitly.\n\n## Does this PR introduce any user-facing change?\n\n- [x] Does this PR introduce any public API change? Adds `JsonInclude`,\n`JsonProperty.Include.NON_DEFAULT` and `JsonValueCodec.isEmpty`; expands\nScala `NON_EMPTY` behavior.\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\nThe following measurements apply to the earlier implementation at\n`243a1a0a6c9e573e29f74eb66b4a6aacd23b3fa2`, not the subsequent cleanup\nand codec cache changes. Benchmarks were not rerun for this revision.\n\nUnchanged `benchmarks/java` MediaContent JSON serialization, compared\nwith base `2144dd32e6a750a245f39059afcae922182e118a` on Apple M4 Pro,\nmacOS arm64, OpenJDK 25.0.3. Four adjacent baseline/current pairs per\noperation, alternating order; one thread/fork, 3 x 1 s warmup, 5 x 1 s\nmeasurement, 1 GiB heap, Parallel GC, JMH GC profiler. Runs were serial.\n\n| Compact operation | Baseline mean (ops/s) | Compared mean (ops/s) |\nMean change | Paired median change | Allocation, both versions |\n| --- | ---: | ---: | ---: | ---: | ---: |\n| String | 8,343,127 | 8,497,861 | +1.85% | +2.46% | 528 B/op |\n| UTF-8 bytes | 10,602,769 | 10,995,876 | +3.71% | +2.86% | 504 B/op |\n\nPaired ranges were -4.25% to +7.16% for String and +2.08% to +7.05% for\nUTF-8. These measurements do not establish a stable speedup, a\nper-platform regression ceiling, or performance of the latest revision.\nNo jsoniter comparison was run for this change."
    },
    {
      "commit": "2144dd32e6a750a245f39059afcae922182e118a",
      "tree": "e12dc12f7cfd0b10af7d8d8f46ce79dfa8903c90",
      "parents": [
        "509a096aa3ac68c0ca9ee248d085db7855523584"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 21 15:02:22 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 12:32:22 2026 +0530"
      },
      "message": "feat(json): add per-call pretty output for strings and bytes (#4073)\n\n## Why?\n\nFory JSON needs readable output selectable for each serialization call\nwithout changing the compact defaults of a shared instance.\n\n## What does this PR do?\n\n- Add `ForyJson.toPrettyJson(Object)` and\n`ForyJson.toPrettyJsonBytes(Object)` for String and UTF-8 output.\n- Emit indentation during serialization, using two spaces, LF line\nbreaks, multiline objects and arrays, and Jackson-style colon spacing.\nPretty output is selected per call, with no builder or `JsonConfig`\noption.\n- Support generated and interpreted codecs, Latin1 and UTF16 strings,\nJava and Scala containers, field inclusion, unwrapped fields, and raw\nJSON values. Preserve compact fused field writes and reuse collection\nwriter generation for String object collections.\n- Add usage documentation, regression coverage, and a benchmark report\nwith all retained measurements.\n\nValidation passed: the full Java JSON suite (1,200 tests), 66 focused\npretty/generated/async tests, 39 tests with compact strings disabled,\ntwo Jackson output comparisons, and focused Scala 2.13/3 tests in both\nFory and the jsoniter-scala benchmark checkout. Spotless, Checkstyle,\nand Markdown formatting checks passed. GraalVM was not run.\n\n## Does this PR introduce any user-facing change?\n\n- [x] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n```java\nString text \u003d json.toPrettyJson(value);\nbyte[] utf8 \u003d json.toPrettyJsonBytes(value);\n```\n\nExisting output methods remain compact. Raw JSON values are emitted\nverbatim.\n\n## Benchmark\n\nMatched JMH runs on Apple M4 Pro / OpenJDK 25.0.3, using unchanged\nGoogle Maps and MediaContent workloads:\n\n| Workload | Paired geometric throughput change | One-sided 95% lower\nbound | Pairs |\n| --- | ---: | ---: | ---: |\n| Google Maps pretty UTF-8 vs jsoniter-scala | +21.39% | +17.89% | 4 |\n| MediaContent compact UTF-8 vs base `509a096aa` | +0.87% | -2.71% | 4 |\n| MediaContent compact String vs base `509a096aa` | -1.35% | -6.27% | 6\n|\n\nThe pretty comparison demonstrates more than 10% higher throughput.\nCompact point estimates are within the 2% regression threshold, but the\nmeasurements do **not** establish a stable regression below 2%; the\ncompact performance safeguard remains unresolved. Compact allocation is\nunchanged at approximately 504 B/op for UTF-8 and 528 B/op for String.\n\nBoth pretty implementations use multiline arrays and objects. Fory uses\nJackson-style spaces on both sides of colons; jsoniter-scala retains its\noriginal after-colon spacing. No model, input, or expected-output\nfixtures were changed.\n\nSee [the benchmark\nreport](https://github.com/chaokunyang/fory/blob/json-pretty-printing/docs/benchmarks/json/pretty-printing.md)\nfor exact revisions, commands, environment, allocation results, and all\nretained samples."
    },
    {
      "commit": "509a096aa3ac68c0ca9ee248d085db7855523584",
      "tree": "7266c0db0d67227c456285333027562e0e5159b3",
      "parents": [
        "a122af12003f3b40c9bb3295ac9e141d4f999fa5"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 21 11:58:45 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 09:28:45 2026 +0530"
      },
      "message": "fix(json): correct Scala codecs and Scala/Kotlin missing-field defaults (#4072)\n\n## Why?\n\nSeveral documented Scala JSON values cannot be written, and the shared\ngeneric recursion guard rejects finite types such as\n`Box\u003cBox\u003cInteger\u003e\u003e`. Missing constructor properties also need useful\nlanguage defaults while preserving Kotlin\u0027s non-null reference\nconstraints.\n\n## What does this PR do?\n\n- Default omitted Scala constructor parameters to `None`, numeric zero,\n`false`, fresh empty collections/arrays, or `null` as appropriate.\nExplicit constructor defaults take precedence.\n- Default omitted Kotlin non-null scalars to zero/false and nullable\nparameters to null. Explicit defaults still apply; non-null references\nwithout defaults, such as `val name: String`, remain required.\n- Support `ScalaTypeRef[Unit]` and nested Unit occurrences through the\nexisting JSON null representation. Java `void` root writes remain\nrejected, and `Some(())` retains the documented value-or-null Option\nrepresentation.\n- Fix populated immutable Queue, primitive mutable ArraySeq, specialized\nTuple1/Tuple2, Duration.Undefined, and primitive generic case-class\ncodegen writes.\n- Accept finite nested instantiations of the same generic class while\ncontinuing to reject expanding recursive declarations. Generated\nreaders/writers distinguish the complete child schema from self\nreferences, and generated class keys preserve that distinction.\n- Support parameterless Scala 3 enum keys in typed Scala maps. Reject\nunsupported case-class constructors through the Scala model instead of\nsilently losing fields in the ordinary object path.\n- Complete the relevant coverage from #4067 across generated/interpreted\noperations, String/UTF-8 readers and writers, constructor shapes,\ncollection implementations, enum keys, and generic types; update the\nScala and Kotlin guides.\n\n## Validation\n\n- Java JSON focused regression suites: 293 passed (`JsonContainerTest`,\n`JsonCreatorTest`, `JsonModuleTest`, `JsonGeneratedCapabilityKeyTest`,\n`JsonAnyPropertyTest`, `JsonUnwrappedTest`).\n- Scala JSON suites: 82 passed on Scala 2.13.18; 92 passed on Scala\n3.3.8.\n- Kotlin JSON suite: 122 passed on Kotlin 2.3.20.\n- Java Spotless/Checkstyle, Kotlin Spotless, Markdown Prettier, and `git\ndiff --check` passed.\n- Local runtime validation used GraalVM JDK 21.0.11 in JVM mode.\nNative-image execution was not run locally.\n\n## Related issues\n\nFixes #4067\nFixes #4068\nFixes #4069\n\n## Does this PR introduce any user-facing change?\n\nMissing Scala properties now use constructor or type defaults. Missing\nKotlin properties use explicit defaults first, then zero/false for\nnon-null scalars or null for nullable types. Kotlin non-null references\nstill reject missing values. The previously failing Scala values and\nfinite nested generic types now work as documented. No binary protocol\nchange."
    },
    {
      "commit": "a122af12003f3b40c9bb3295ac9e141d4f999fa5",
      "tree": "4951c4c2b0fe54cd8a6b4b34cdffc16b8c03b58a",
      "parents": [
        "f1a28adb6e24438700ed887f843407e564095966"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 21 11:42:32 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 09:12:32 2026 +0530"
      },
      "message": "fix(java): cache JSON method lambda visibility checks (#4071)\n\n## Summary\n\nShort-circuit the JSON method-lambda visibility check when the model\nshares Fory\u0027s classloader or is bootstrap-loaded. Cache the visibility\nresult for other loaders so getter/setter construction across classes in\nthe same loader reuses successful and failed lookups.\n\nThe cache is a `ConcurrentHashMap` keyed by\n`System.identityHashCode(loader)`. Values hold a weak loader reference\nand the visibility boolean, allowing loader unloading and checking\nactual identity on hits to handle hash collisions. The map is cleared\nwhen its size exceeds 1024; accessors already retained by codecs remain\nusable. Classloader calls run outside map callbacks; simultaneous\ninitial misses may repeat the lookup. Loader identity is checked before\nthe bootstrap shortcut, preserving support for bootstrap-loaded Fory.\n\nThis combines Options A and B from #4066 and affects codec construction\nonly.\n\nFixes #4066.\n\n## Validation\n\n- The new visibility regression failed before caching: 4 lookups instead\nof 1. It verifies multiple declaring classes, repeated getters/setters,\nvisible and isolated loaders, and distinct loaders with equal\n`equals`/`hashCode` results.\n- Deterministic regressions cover identity-hash collisions, retaining\n1024 entries, and clearing the cache when the next entry exceeds the\nlimit.\n- `mvn -B -T16 -pl fory-json test spotless:check checkstyle:check` on\nJDK 21: 1,181 tests passed, Spotless and Checkstyle passed. This\nincludes typed method accessors, bootstrap method accessors, and the\nforced-Android subprocess coverage. The property suite was rerun after\nstrengthening the 1024-entry boundary assertion.\n- Java formatting and Markdown formatting checks passed."
    },
    {
      "commit": "f1a28adb6e24438700ed887f843407e564095966",
      "tree": "c96640246e24d042bf50e614a022aeb58fdf6b89",
      "parents": [
        "7b3f683835bebeffe4830ea4c1a77554399bfbd3"
      ],
      "author": {
        "name": "PJ Fanning",
        "email": "pjfanning@users.noreply.github.com",
        "time": "Mon Sep 21 03:05:31 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 07:35:31 2026 +0530"
      },
      "message": "test(scala): cover documented fory-json-scala types and error paths (#4070)\n\n## What does this PR do?\n\nAdds tests to `ScalaJsonSuite` for `fory-json-scala` behaviour that is\ndocumented in `docs/json/scala.md` but had no coverage (#4067).\nTest-only change, no production code.\n\nNew cases, all run on Scala 2.13 and 3 and, where the existing suite\ndoes so, on both the interpreted and generated codecs:\n\n- `BigDecimal` and Scala `StringBuilder`: round trips, quoted tokens,\n`null`, invalid tokens, graph-memory rejection\n- `Duration`: `Inf`/`MinusInf` writes, `Undefined` read,\n`FiniteDuration` rejecting `special`, every `TimeUnit`, and the\ninvalid-object branches\n- `Range` and `NumericRange`: empty, single, negative step,\nnon-progression and overflow rejection, `Byte`/`Short`/`Char`/`BigInt`\nelements, write-only raw `NumericRange`, unsupported `Double`\n- Declared collection and map kinds that were untested (`ArrayBuffer`,\n`ListBuffer`, `ArrayDeque`, `mutable.Queue`, `LinkedHashSet`, abstract\n`IndexedSeq`/`LinearSeq`/`Buffer`/`mutable.Seq`, `VectorMap`, `ListMap`,\n`SeqMap`, `AnyRefMap`, `mutable.HashMap`, `im.HashMap`), insertion order\nfor ordered kinds, `Nil` and `::` declared, `Map[Int, String]`, nested\nand null-element collections, read-side batch reservation above 1024\nelements\n- Runtime writes for those kinds and the documented rejection of sorted\ncollections\n- The rejected runtime-state families (`Stream`, `Iterator`, views,\n`Try`, `Future`, `Promise`, `Deadline`, `Regex`, `Symbol`, functions,\n`Ordering`) as roots and as fields\n- `Option` fields (omitted, `null`, present, required), nested `Option`,\n`Some(null)`\n- `Tuple1`, too-long tuple, `null` tuple and element, nested tuples,\nUTF-8 input\n- `String` value class at root, in `List`/`Map`/`Option`, and `null`\n- Root `BoxedUnit`, non-null `Unit` rejection, `case object`, nested\nobject singleton\n- Generic case class through `TypeRef` and as a field, `var` constructor\nparameters, a 24-parameter case class, missing required and unknown\nproperties, `maxDepth` on a recursive case class\n- Explicit `@JsonSubTypes` sealed trait with a case-object leaf in the\nshared suite (previously only the Scala 3 inferred path was tested)\n- `ScalaEnumerationCodec` through `registerCodec`, custom `Value(id,\nname)` names, unknown-name rejection, duplicate-name constructor\nrejection\n- `BigDecimal`, `StringBuilder`, `Duration`, `Range`, tuple, value\nclass, `ArrayBuffer`, `ListMap` and `LinkedHashSet` as case-class fields\nunder codegen\n\nCases that turned out to fail on `main` are deliberately left out and\nfiled as #4068 (Scala write paths) and #4069 (core generic-recursion\nguard).\n\n## Related issues\n\nRefs #4067, #4068, #4069\n\n## Does this PR introduce any user-facing change?\n\n- [x] Does this PR introduce any public API change? No\n- [x] Does this PR introduce any binary protocol compatibility change?\nNo\n\n## Benchmark\n\nNot applicable, test-only.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nThis code is just test coverage and was not run with `ai_review` because\nthat takes a very long time to run with multiple review agents confusing\neach other and causing work to be done over and over again.\n\nCo-authored-by: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "7b3f683835bebeffe4830ea4c1a77554399bfbd3",
      "tree": "d4c84c7032bd35a09e09bad6b7f933db0fbff961",
      "parents": [
        "0da73ac58832bf9720b7794bb803a52b53572718"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 21 09:35:26 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 07:05:26 2026 +0530"
      },
      "message": "feat(java): improve json type support (#4064)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "0da73ac58832bf9720b7794bb803a52b53572718",
      "tree": "9e448a512f99f2c736716ce8416c4a629570afa1",
      "parents": [
        "771a44355558901ddaed222d087f0e45f3e214d7"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 20 22:53:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 20:23:09 2026 +0530"
      },
      "message": "docs: update release version to 1.7.4 (#4065)\n\nUpdate README, installation guides, and examples to recommend Apache\nFory 1.7.4 after the RC1 vote passed. Keep the existing 1.8.0\ndevelopment package versions unchanged.\n\nValidation: ran the repository version-bump script with `-version\n1.8.0-dev -release-version 1.7.4`, formatted changed Markdown, and\nverified all 86 replacements are version-only. `git diff --check`\npassed. No local builds or tests were run for this documentation-only\nchange."
    },
    {
      "commit": "771a44355558901ddaed222d087f0e45f3e214d7",
      "tree": "e66453a52008db3ed274de3245280adc4d0916b6",
      "parents": [
        "31eb5ea5b5c63e216edbbe97aec48ac8f3e77f74"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 20 15:43:25 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 13:13:25 2026 +0530"
      },
      "message": "feat(python): support collection subclass (#4063)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #3250 \n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "31eb5ea5b5c63e216edbbe97aec48ac8f3e77f74",
      "tree": "9f3dab0c27e524ac46e846024c288ca34d7f392f",
      "parents": [
        "c0b0464f0594e9d2ef7520d756b1b58883a88ea1"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 20 12:22:01 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 09:52:01 2026 +0530"
      },
      "message": "fix(python): support named tuples and temporal array buffers (#4062)\n\n## What does this PR do?\n\nFix Python native named-tuple round trips by serializing their tuple\nelements and reconstructing the concrete class with its field values.\nPreviously, named tuples were treated as ordinary objects with empty\nslots, causing missing-constructor-argument errors or silently restoring\ndefaults. Preserve explicit registration, shared references,\ninstantiation policies, and graph-memory accounting.\n\nExport contiguous NumPy datetime/timedelta arrays through a zero-copy\nbyte view so DataFrames with datetime indexes or columns work with\nout-of-band buffers. Preserve dtype, shape, temporal units, and NaT\nvalues, including scalar and empty arrays.\n\nFixes #4056.\nFixes #4057.\n\n## Validation\n\n- Reproduced both reports with Python 3.13.8, NumPy 2.3.3, and pandas\n2.3.3 on main at `c0b0464f0594e9d2ef7520d756b1b58883a88ea1`.\n- 52 focused regression cases passed in both Python and Cython modes.\n- Full Python-mode suite: 883 passed, 35 skipped. Full Cython-mode\nsuite: 888 passed, 30 skipped.\n- Ruff 0.15.22, Prettier, and both updated documentation examples\npassed.\n- Local numeric-array out-of-band round-trip microbenchmark: added dtype\ndispatch cost about 0.02–0.05 microseconds (1.1–2.6%) in the measured\ncases; temporal-array tests verify shared backing memory.\n\nThe changes affect Python native serialization only and do not change\nthe shared xlang protocol."
    },
    {
      "commit": "c0b0464f0594e9d2ef7520d756b1b58883a88ea1",
      "tree": "0c7c105e5cdf0072469216eb57ddc9877eaba8f5",
      "parents": [
        "05109af54677f7fcd1109542f61a0101cf20b20b"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 20 11:54:04 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 09:24:04 2026 +0530"
      },
      "message": "perf(java): share JSON reader and writer byte buffers (#4061)\n\n## Why?\n\n\n\n## What does this PR do?\n\nReuse buffer between writer/reader to reduce memory footprint\n\n## Related issues\n\n#4058 \n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "05109af54677f7fcd1109542f61a0101cf20b20b",
      "tree": "4157bb87af69e951ca161c2e1a5bbb1b3aef2aa8",
      "parents": [
        "1b9ca11d1de4c2bb42ea8f3d9e395eded47e69e0"
      ],
      "author": {
        "name": "Zheng Feng",
        "email": "zh.feng@gmail.com",
        "time": "Sun Sep 20 10:50:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 08:20:20 2026 +0530"
      },
      "message": "fix(java): guard LambdaGetterJsonAccessor and LambdaSetterJsonAccessor with GraalvmSupport.isGraalBuildTime() (#4060)\n\n## Description\n\nPrevent LambdaMetafactory from creating runtime classes during GraalVM\nNative Image compilation. Classes cannot be defined at runtime by\ndefault in AOT compilation.\n\n## Fix\n\nAdd check to both and to ensure lambda classes are only created during\nGraalVM build time (via the Native Image Feature), not at runtime.\n\nFixes #4059\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "1b9ca11d1de4c2bb42ea8f3d9e395eded47e69e0",
      "tree": "133ed9f0821c4608b37011662ca75ed11b690702",
      "parents": [
        "180d6a70e918a7c945fe09437e8fed0cec7a5b73"
      ],
      "author": {
        "name": "Pavel Ptashyts",
        "email": "49400901+pavel-ptashyts@users.noreply.github.com",
        "time": "Sun Sep 20 04:44:49 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 08:14:49 2026 +0530"
      },
      "message": "perf(java): copy plain runs between escapes when decoding json strings (#4058)\n\nCloses #4055.\n\n### What this changes\n\nOnce a JSON string contains its first escape, all three readers decode\nthe rest of that string one character per\nloop iteration and never return to the word scanner. The cost of a\nstring is therefore proportional to the\ndistance from its **first** escape to its end, not to the number of\nescapes it contains.\n\nThis reuses the scanner that already found the escape to find the next\nstop character, and copies the plain run\nbetween them in one pass - `System.arraycopy` for `Utf8JsonReader` and\n`Latin1JsonReader`, a packing loop for\n`Utf16JsonReader` whose characters are two bytes wide while the latin1\noutput is one byte each. Each reader keeps\nits own stop mask, so a run stops exactly where the character-at-a-time\npath would have handled the character\nitself: the utf8 scan excludes high-bit bytes, the latin1 scan admits\nthem because they are valid payload, and the\nutf16 scan ors in `word \u0026 UTF16_NON_LATIN_BYTES` so it stops at every\ncharacter the latin1 output cannot hold.\n\nA second, independent change is in `clear()`. A decode buffer larger\nthan `RETAINED_STRING_DECODE_BUFFER_SIZE`\nwas replaced by a fresh 8 KiB array after every parse. Readers are\npooled, so a document with a string larger than\n8 KiB re-grew the buffer by doubling on every single parse, and the\ngrowth arrays plus the replacement were\ngarbage each time. The readers now record the longest output decoded\nsince the last `clear()` - from\n`finishDecodedString` for a `String` and from `decodeQuotedText` for the\n`CharSequence` view, since both grow the\nsame buffer - and shrink only when the buffer is at least twice that.\nConsecutive large documents therefore stop\nre-growing it, while `MAX_RETAINED_STRING_DECODE_BUFFER_SIZE` bounds\nwhat any single document can leave pinned in\na pooled reader; above that the buffer is released whatever the shrink\nthreshold says.\n\n### Benchmark data\n\nI do not have numbers from `benchmarks/java`; these are from the\napplication harness where the problem was found,\nand I am glad to run whatever you would rather see. JDK 25, min of 7\nrounds of 300 iterations, both libraries\nwarmed over every document before anything is timed, rounds alternating\nbetween the libraries.\n\nSix real OpenRTB bid responses, 12-110 KB, each roughly 95% one string\nholding VAST XML: pure ASCII, about 100\nescaped quotes, the **first** of them at character 14 of 20006. Read\nfrom `byte[]` into the same model.\n\n| | before | after |\n|---|---|---|\n| ns/document, total | 609691 | 99550 |\n| allocated bytes/document, total | 934976 | 295664 |\n| Jackson 3 on the same documents, same run | 213791 ns / 511184 B |\n229863 ns / 511191 B |\n\n6.1x against the current code, and it turns a 2.9x loss against Jackson\ninto a 2.3x win, with 1.7x less\nallocation than Jackson rather than 1.8x more. Jackson drifts about 7%\nbetween the two runs, which is this\nmachine\u0027s noise floor; the Fory column moves by six times. The\n`fromString` paths improve on the same documents\ntoo: 3.2-5.8x for `Latin1JsonReader` and 1.8-2.3x for `Utf16JsonReader`.\n\nThe cause is isolated by changing only the escapes inside that one\nstring, keeping its length at 20006\ncharacters:\n\n| variant | before | Jackson 3 |\n|---|---|---|\n| no escapes at all | 7036 | 12385 |\n| one escape, at the very end | 10104 | 10169 |\n| one escape, at character 1 | 41833 | 13562 |\n| the real document, 106 escapes | 42533 | 14610 |\n\nWith no escape the reader is already 1.76x faster than Jackson, and one\nescape near the front costs the same as a\nhundred of them.\n\n### Tests\n\n- `JsonStringTest.readEscapeFollowedByNonAsciiText` is new: an escape\nfollowed by latin1 text, text outside\nlatin1, a surrogate pair and mixtures of them, varying both the text\nbefore the escape and the gap between the\nescape and the non-ascii character so the stop lands in every lane of a\nscanned word, driven through all three\n  readers.\n- `JsonStringTest.rejectMalformedInputAfterAnEscape` is new: an\nunterminated string, a raw control character, a\nbad escape and an unpaired high surrogate, each both inside a scanned\nword and in the scalar remainder. The new\nblock sits between the escape handling and those checks, so they have to\nkeep firing.\n- `JsonStringTest.readerDecodeBufferShrinks` pinned the old\nunconditional shrink and is replaced by\n`readerDecodeBufferIsKeptWhileNeeded`, which pins the new policy for all\nthree readers and for the\n`readQuotedText` path: the buffer survives a `clear()` while documents\nstill need it, is released once one does\n  not, and is released regardless once it exceeds the ceiling.\n\nOne gap I did not close: the test pins that a buffer grown only through\n`decodeQuotedText` is kept, but not that\nit is released.\n\n### Human verification\n\nOn JDK 25.0.2, Windows, from `java/`:\n\n- `mvn -pl fory-core -am -DskipTests install`, which the fory-json java9\nmodule step needs, then\n`mvn -pl fory-json clean test spotless:check checkstyle:check`: **1146\ntests, 0 failures, 0 errors, 0 skipped**,\n  spotless clean, **0 checkstyle violations**.\n- Baseline for comparison, same commands on a pristine worktree of\n`main`: 1144 tests, 0 failures.\n- I reverted the utf16 scan to a form without the non-latin stop and\nconfirmed `readEscapeFollowedByNonAsciiText`\n  fails, then restored it and confirmed the suite is green again.\n- I have not run `benchmarks/java`.\n\n```text\nAI Usage Disclosure\n- substantial_ai_assistance: yes\n- scope: design drafting, code drafting, tests\n- affected_files_or_subsystems: java/fory-json/src/main/java/org/apache/fory/json/reader (three readers),\n  java/fory-json/src/test/java/org/apache/fory/json/JsonStringTest.java\n- ai_review: line-by-line self-review first, then a two-reviewer loop repeated until clean - one reviewer guided\n  by AGENTS.md and .agents/ci-and-pr.md, one independent reviewer in a separate clean-context session outside\n  this repository, given no project guidance. The loop found six blocking defects, all in what this change adds.\n  Four in the code: the utf16 run accepted characters above 0xFF and packed them into one byte; a bound\n  computation could overflow near Integer.MAX_VALUE; the quoted-text decode path grew the shared buffer without\n  recording it; and the retention ceiling was applied to the shrink size but not to the shrink condition, so a\n  buffer up to twice the ceiling survived clear(). Two in the tests: the ceiling case did not actually depend on\n  the ceiling condition, and it used a reader constructor that throws on jdk 8. Ten further optional findings\n  were addressed; one was not and is named above. Both reviewers report no further actionable findings on commit\n  d950b0b, which is the head of this pull request.\n- ai_review_artifacts: the final verdicts are quoted below; full transcripts available on request.\n- human_verification: the commands and results in the section above; I read the diff line by line and can\n  explain and defend every line of it.\n- performance_verification: the before/after table above, taken on the application harness that found the\n  problem, not on benchmarks/java. The independent reviewer additionally ran a differential fuzz of this tree\n  against the same tree with the three readers reverted: 30000 random documents (ascii, latin1 high bytes,\n  U+0100-U+FFFF, supplementary pairs, every escape form, lengths 1-70) through fromJson(String), fromJson(byte[])\n  and each reader directly, all exact, plus a transcript over 94981 truncated prefixes recording result, string\n  coder, length and hash or exception class, message and position - sha256 identical between patched and\n  baseline.\n- provenance_license_confirmation: Apache-2.0-compatible provenance confirmed; no third-party code introduced.\n```\n\nFinal review results, both on commit d950b0b.\n\nFory-guided reviewer:\n\n\u003e No further actionable findings in commit `d950b0b`; this read-only\nreview relies on your reported JDK 25\n\u003e validation results.\n\nIndependent reviewer:\n\n\u003e I have no further actionable findings in the revised patch.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Claude Opus 5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "180d6a70e918a7c945fe09437e8fed0cec7a5b73",
      "tree": "5fbc601085082acc5e8a144af509018ae8486173",
      "parents": [
        "3b2d6bb37b180caa0a7315ad934f6a746c5ef7f0"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Thu Sep 17 18:31:28 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 16:01:28 2026 +0530"
      },
      "message": "feat(kotlin): support runtime Kotlin JSON type tokens (#4054)\n\nFramework callbacks cannot use a reified Kotlin type parameter, and\nwrapping their Java `Type` loses the Kotlin nullability needed to\nserialize generic responses such as `Rt\u003cList\u003cEmployee\u003e\u003e`.\n\nAdd `jsonTypeRef\u003cT\u003e(KType)` using the existing structural type\nconversion, so callbacks can retain the controller\u0027s declared Kotlin\ntype and pass it to Fory. The reified helper uses the same entry point.\nA dedicated integration guide introduces spring-fory and explains Kotlin\nruntime type discovery and Spring adapter requirements. `kotlin-reflect`\nremains an application dependency and is added only to tests here.\n\nFixes #4053.\n\nValidation:\n- All 121 `fory-json-kotlin` tests passed with Kotlin 2.3.20 / JDK 21,\nincluding reflected generic roots, nested nullability, defaults,\nunsigned values, and incomplete type rejection.\n- Spotless and Markdown formatting passed.\n- The documented external-consumer example compiled and round-tripped\nsuccessfully with Kotlin 2.4.10 / JDK 26.\n- No complete Spring application was run."
    },
    {
      "commit": "3b2d6bb37b180caa0a7315ad934f6a746c5ef7f0",
      "tree": "eaf7e5aa29e7703729f989584990835c651073da",
      "parents": [
        "0235b079dc9f5e338417945e2ab13184e67e4122"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Thu Sep 17 15:28:49 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 12:58:49 2026 +0530"
      },
      "message": "fix(java): assert non-nullable field values before serialization (#4052)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "0235b079dc9f5e338417945e2ab13184e67e4122",
      "tree": "ea43094c77d731537b285fe17c6761724469727c",
      "parents": [
        "7720dbbfe755d28a3a178616dbedc960b3be061e"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Wed Sep 16 09:25:47 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 09:25:47 2026 +0800"
      },
      "message": "docs: update release version to 1.7.3 (#4050)\n\nUpdate installation instructions, README badges, and external C++\nexamples from Apache Fory 1.7.2 to 1.7.3, and add the 1.7.3 entries to\nthe Dart changelogs. The existing 1.8.0 development versions remain\nunchanged.\n\nGenerated version updates with `ci/release.py bump_version -l all\n-version 1.8.0-dev -release-version 1.7.3`. Verified the version-only\ndiff, formatted all changed Markdown with Prettier, and passed `git diff\n--check`. Runtime builds and tests are left to CI for this documentation\nand version-reference change."
    },
    {
      "commit": "7720dbbfe755d28a3a178616dbedc960b3be061e",
      "tree": "34fa5d640bcb036c3099fb1b0ef912296e5c5641",
      "parents": [
        "677049dee9dcaebcfd528d4fb5db4fb879faf426"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Sep 15 13:40:05 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 11:10:05 2026 +0530"
      },
      "message": "fix(java): avoid JDK 8 ARM Unsafe address miscompilation (#4049)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #4017\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "677049dee9dcaebcfd528d4fb5db4fb879faf426",
      "tree": "ff74ffdfdbe4fcd00f4acffae4f62b13774a392d",
      "parents": [
        "da7e557f509af3652d865d82e2950176b9a8553b"
      ],
      "author": {
        "name": "aditya0za005-ux",
        "email": "aditya0za005@gmail.com",
        "time": "Tue Sep 15 08:38:58 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 08:38:58 2026 +0530"
      },
      "message": "fix(java): preserve compatible registered field type (#4048)\n\n## Why?\n\nIn compatible mode, a registered `java.util.Date` field can be assigned\nthe `TIMESTAMP` type ID. During sequential serializer generation, that\ntype ID was resolved back to `java.time.Instant`, causing a field type\nmismatch even though the declared Java type and registered type ID\nmatched.\n\n## What does this PR do?\n\nPreserves the declared Java type in `RegisteredFieldType.toTypeToken()`\nwhen its registered type ID matches the compatible field type ID.\n\nAdds a regression test for a class containing a `java.util.Date` field.\nThe test covers serialization, deserialization, and verifies that the\n`Date` value is preserved.\n\n## Related issues\n\nFixes #4047\n\n## Validation\n\n`mvn -pl fory-core -am \"-Dtest\u003dBug4047Test\"\n\"-Dsurefire.failIfNoSpecifiedTests\u003dfalse\" test`\n\n`mvn -pl fory-core -am spotless:check`\n\nBoth pass.\n\n## AI Usage Disclosure\n\n- substantial_ai_assistance: yes\n- scope: code investigation, implementation suggestions, regression test\ndesign, review feedback\n- affected_files_or_subsystems: java/fory-core FieldTypes compatible\ntype resolution and Bug4047Test\n- ai_review: line-by-line self-review completed; two fresh AI reviewers\ncompleted; both final reviews reported no further actionable comments\n- ai_review_artifacts: final review results retained from the\nFory-guided and independent general review sessions\n- human_verification: ran the targeted Bug4047Test and Spotless check\nlocally; both passed and results were reviewed\n- performance_verification: no benchmark run; change is a small targeted\ntype-resolution fix and no measured performance regression was observed\nin the targeted validation\n- provenance_license_confirmation: reviewed the contribution for\nlicensing/provenance compliance and confirmed no third-party copyrighted\ncode was introduced\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "da7e557f509af3652d865d82e2950176b9a8553b",
      "tree": "b414b7eb4695a29767dddd6b82d937d41815101a",
      "parents": [
        "18ed6e355741836b95450473a56e746036f1bdec"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 14 22:13:55 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 19:43:55 2026 +0530"
      },
      "message": "fix(license): restore dataclasses and gRPC attributions (#4046)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "18ed6e355741836b95450473a56e746036f1bdec",
      "tree": "29ddef210a11b873dfcc32698404d0bb5e353f06",
      "parents": [
        "c5c67eb2b8df07f647160123ac44c58d0110931a"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 14 11:10:03 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 08:40:03 2026 +0530"
      },
      "message": "perf(java): optimize json write/read perf (#4045)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "c5c67eb2b8df07f647160123ac44c58d0110931a",
      "tree": "4d3906793e1b56ccf0cb3c951d2b024c0f45145e",
      "parents": [
        "28d21311e5ff3c975842ef4a4d300c1e1edf40c9"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 13 16:30:04 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 13 14:00:04 2026 +0530"
      },
      "message": "perf(java): optimize json write/read perf (#4044)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "28d21311e5ff3c975842ef4a4d300c1e1edf40c9",
      "tree": "972c1c60da6b4a2d596e4cae715b8c018464cf95",
      "parents": [
        "c85cf045c2af1093cbdd28841d511f45c437a77d"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 13 01:07:39 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 22:37:39 2026 +0530"
      },
      "message": "docs(release): preserve RCs for infrastructure retries (#4043)\n\n## Why?\n\nA transient CI dependency-download timeout caused an unchanged release\ncommit to receive another RC tag and duplicate Maven publication. The\nrelease skill incorrectly treated every failed release step as\ninvalidating the candidate.\n\n## What does this PR do?\n\nKeep the existing commit, RC tag, and verified artifacts when retrying\ninfrastructure failures. Diagnose failures and retry only the failed or\nincomplete steps, checking remote state before repeating publication\noperations. Require a substantive release fix before creating a higher\nRC, while preserving immutable tags and the existing vote-readiness\nchecks.\n\n## Validation\n\n- Prettier on the changed skill.\n- Skill creator quick validation.\n- `git diff --check`.\n- Verified the documented `gh run rerun --failed` command against CLI\nhelp."
    },
    {
      "commit": "c85cf045c2af1093cbdd28841d511f45c437a77d",
      "tree": "3e6e6faf3f40f6824aac1e94cab07fecdb78e285",
      "parents": [
        "3ceaa3b1143b104d956f32c056c6cd139f7f1aa2"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 13 00:36:06 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 22:06:06 2026 +0530"
      },
      "message": "perf(java): optimize timezone json read performance (#4042)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "3ceaa3b1143b104d956f32c056c6cd139f7f1aa2",
      "tree": "e66c377bb70224badd03c48e22e30ab0cc92feea",
      "parents": [
        "af819581ef716a77c838cd011e49a84d8e993d9a"
      ],
      "author": {
        "name": "wuwangben",
        "email": "739061411@qq.com",
        "time": "Sun Sep 13 00:20:23 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 21:50:23 2026 +0530"
      },
      "message": "fix(java): Fix inconsistency in exception handling when reading EOF stream (#2821)\n\n\u003c!--\n**Thanks for contributing to Apache Fory™.**\n\n**If this is your first time opening a PR on fory, you can refer to\n[CONTRIBUTING.md](https://github.com/apache/fory/blob/main/CONTRIBUTING.md).**\n\nContribution Checklist\n\n- The **Apache Fory™** community has requirements on the naming of pr\ntitles. You can also find instructions in\n[CONTRIBUTING.md](https://github.com/apache/fory/blob/main/CONTRIBUTING.md).\n\n- Apache Fory™ has a strong focus on performance. If the PR you submit\nwill have an impact on performance, please benchmark it first and\nprovide the benchmark result here.\n--\u003e\n\n## Why?\n\n\u003c!-- Describe the purpose of this PR. --\u003e\n\n## What does this PR do?\n修改读取EOF流异常不一致问题\n\u003c!-- Describe the details of this PR. --\u003e\n\n## Related issues\n#2772 \n\u003c!--\nIs there any related issue? If this PR closes them you say say\nfix/closes:\n\n- #xxxx0\n- #xxxx1\n- Fixes #xxxx2\n--\u003e\n\n## Does this PR introduce any user-facing change?\n\n\u003c!--\nIf any user-facing interface changes, please [open an\nissue](https://github.com/apache/fory/issues/new/choose) describing the\nneed to do so and update the document if necessary.\n\nDelete section if not applicable.\n--\u003e\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\n\u003c!--\nWhen the PR has an impact on performance (if you don\u0027t know whether the\nPR will have an impact on performance, you can submit the PR first, and\nif it will have impact on performance, the code reviewer will explain\nit), be sure to attach a benchmark data here.\n\nDelete section if not applicable.\n--\u003e\n\n---------\n\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "af819581ef716a77c838cd011e49a84d8e993d9a",
      "tree": "0c6bf56efd92b0709a61488967d04bc5adea999f",
      "parents": [
        "bfca39fa75ade8412057207f85cf0d6e34725028"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Sat Sep 12 21:43:50 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 21:43:50 2026 +0530"
      },
      "message": "feat(go): support native fory row format (#3901)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark\n\n---------\n\nCo-authored-by: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "bfca39fa75ade8412057207f85cf0d6e34725028",
      "tree": "c7b55addd994a704d9114c0c27ca36549a38077a",
      "parents": [
        "a4a638322d9b6c5fa5637f5fb1e64a0bbba3a27f"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sun Sep 13 00:07:25 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 21:37:25 2026 +0530"
      },
      "message": "fix(android): align Kotlin JSON inclusion assertions (#4041)\n\nAfter #4040, the Android metadata scenario still expected `label \u003d null`\nto survive a round trip with default inclusion. The writer now correctly\nomits that property, and the reader restores its `\"android-default\"`\nconstructor default, causing both Android API 26 and API 36 CI to fail.\n\nUpdate the scenario to assert omission and default restoration, then\nexplicitly enable `writeNullFields(true)` and verify the null-preserving\nround trip. Cover both String and UTF-8 output/input while retaining the\nexisting metadata, default-mask, singleton, and shared-corpus checks.\n\nValidation is delegated to CI as requested; the local test run was\nstopped before completion.\n\nFixes the [Android CI\nfailure](https://github.com/apache/fory/actions/runs/34702925778/job/103577771632)."
    },
    {
      "commit": "a4a638322d9b6c5fa5637f5fb1e64a0bbba3a27f",
      "tree": "0f9ec7e96310d20eb2b107b2885b489eded37310",
      "parents": [
        "d5529386bd9711e3310cdf1a58b98a8b0dc78ee0"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sat Sep 12 23:40:06 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 21:10:06 2026 +0530"
      },
      "message": "fix(json): honor Kotlin property inclusion (#4040)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #4039 \n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "d5529386bd9711e3310cdf1a58b98a8b0dc78ee0",
      "tree": "6fe0a79b9d14854d253e888487c04f9354916bb3",
      "parents": [
        "465cbe61f98c53290b8fd96c3af235d80c29c588"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sat Sep 12 18:57:45 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 16:27:45 2026 +0530"
      },
      "message": "fix(java): restore contexts for nested Externalizable callbacks (#4038)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #4035\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "465cbe61f98c53290b8fd96c3af235d80c29c588",
      "tree": "aabb1ccd397042df5461ea0ebd693a8f5dc38a13",
      "parents": [
        "e9478f01eba54a6510edc9bd8f7aec5676094e92"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sat Sep 12 18:41:07 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 16:11:07 2026 +0530"
      },
      "message": "feat(java): optimize json write/read perf (#4037)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "e9478f01eba54a6510edc9bd8f7aec5676094e92",
      "tree": "9394d1035bbe9918285df98a3f0db85feb2db12a",
      "parents": [
        "0e4868db4537f338c24182bb7a98d0fa2acbc5a9"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Fri Sep 11 23:38:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 21:08:09 2026 +0530"
      },
      "message": "feat(java): optimize json float converter (#4036)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "0e4868db4537f338c24182bb7a98d0fa2acbc5a9",
      "tree": "4da6230cf01ce88c7ec53b45768d714acbcf16e6",
      "parents": [
        "8af7b078ce32b505a2d8c7d7b76ea3e944386718"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Fri Sep 11 17:48:32 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 15:18:32 2026 +0530"
      },
      "message": "perf(java): optimize json perf write/read performance (#4034)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "8af7b078ce32b505a2d8c7d7b76ea3e944386718",
      "tree": "06d15588743896bc192676df1cf53b1c277fe7a0",
      "parents": [
        "6ac124c9f6789a4af0922fb4e5e577e8dccbdba9"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Fri Sep 11 16:29:05 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 13:59:05 2026 +0530"
      },
      "message": "docs: update release version to 1.7.2 (#4033)\n\nUpdate installation snippets, package badges, and C++ example tags to\nthe released Apache Fory 1.7.2 version. Add the 1.7.2 Dart changelog\nentries while retaining the existing 1.8.0 development versions.\n\nValidation: reviewed every version change, formatted all changed\nMarkdown with Prettier, and passed `git diff --check`. This is a\ndocumentation and version-reference update; no local builds or tests\nwere needed."
    },
    {
      "commit": "6ac124c9f6789a4af0922fb4e5e577e8dccbdba9",
      "tree": "8909cd1c23a8065f56d1c9e686f80b6e6aaa09d4",
      "parents": [
        "5c09c3fd1c368a05380bf80cd87346d882ecb714"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Thu Sep 10 19:41:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 17:11:09 2026 +0530"
      },
      "message": "perf(java): accelerate JSON floating-point conversion with integer bounds (#4031)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "5c09c3fd1c368a05380bf80cd87346d882ecb714",
      "tree": "3cf5e5a7cb9bba658915237db4c8c13f1831c623",
      "parents": [
        "d18dcf4b8390ef443fe0160ef3938591ba8da1fd"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 10 09:49:45 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 09:49:45 2026 +0530"
      },
      "message": "chore: Bump js-yaml in /javascript (#4030)\n\nBumps and [js-yaml](https://github.com/nodeca/js-yaml). These\ndependencies needed to be updated together.\nUpdates `js-yaml` from 4.3.1 to 4.3.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md\"\u003ejs-yaml\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.3.2 - 2026-08-26\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[backport] Hard-limit merge sequence size to 100.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSecurity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[backport] Count empty mappings in merge sequences toward\n\u003ccode\u003emaxTotalMergeKeys\u003c/code\u003e\nto limit CPU usage, \u003ca\nhref\u003d\"https://redirect.github.com/nodeca/js-yaml/issues/797\"\u003e#797\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/commit/79ca68d90f333fbe6d9e42827527e62636200191\"\u003e\u003ccode\u003e79ca68d\u003c/code\u003e\u003c/a\u003e\n4.3.2 released\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b\"\u003e\u003ccode\u003ed90b661\u003c/code\u003e\u003c/a\u003e\nBackport merge limits from v5.4.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `js-yaml` from 3.15.1 to 3.15.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md\"\u003ejs-yaml\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.3.2 - 2026-08-26\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[backport] Hard-limit merge sequence size to 100.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSecurity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[backport] Count empty mappings in merge sequences toward\n\u003ccode\u003emaxTotalMergeKeys\u003c/code\u003e\nto limit CPU usage, \u003ca\nhref\u003d\"https://redirect.github.com/nodeca/js-yaml/issues/797\"\u003e#797\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/commit/79ca68d90f333fbe6d9e42827527e62636200191\"\u003e\u003ccode\u003e79ca68d\u003c/code\u003e\u003c/a\u003e\n4.3.2 released\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b\"\u003e\u003ccode\u003ed90b661\u003c/code\u003e\u003c/a\u003e\nBackport merge limits from v5.4.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts page](https://github.com/apache/fory/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d18dcf4b8390ef443fe0160ef3938591ba8da1fd",
      "tree": "7bb41b5f5e17ff803e4befa5627913d06c14008e",
      "parents": [
        "4c1a5c861ba5f5ea47b9bf32be60c900e9d90862"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Sep 08 13:48:16 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 11:18:16 2026 +0530"
      },
      "message": "chore(deps): upgrade grpc-go to 1.83.1 (#4029)\n\nUpgrade `google.golang.org/grpc` from 1.82.1 to 1.83.1 in the Go gRPC\nintegration tests to address HTTP/2 DATA frame fragmentation memory\nexhaustion (CVE-2026-84304 / GHSA-vp52-pcj8-j9qc). Update the required\ngenproto RPC dependency and module checksums.\n\nAddresses [Dependabot alert\n#117](https://github.com/apache/fory/security/dependabot/117).\n\nValidation was not run, as requested."
    },
    {
      "commit": "4c1a5c861ba5f5ea47b9bf32be60c900e9d90862",
      "tree": "8b02b83bea75393e96493c61b316500f7d3da71b",
      "parents": [
        "697295af47c121979c7d6910f32ff0cff3b72651"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Sep 08 12:17:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 09:47:56 2026 +0530"
      },
      "message": "feat(json): support omitting empty properties (#4028)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #4024\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "697295af47c121979c7d6910f32ff0cff3b72651",
      "tree": "43279e72d11eeb34c7a72a09c1658a3240920ef1",
      "parents": [
        "bffa8f198a734aa5ebd2420c044d7cb5d06ddbd7"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Tue Sep 08 00:40:42 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 22:10:42 2026 +0530"
      },
      "message": "fix: fix go thread safe Pool race condition and remove python lazy_import (#4027)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "bffa8f198a734aa5ebd2420c044d7cb5d06ddbd7",
      "tree": "bd120f93e490dce0bc155dbf065bb6cd80eb6a99",
      "parents": [
        "1c2dab3371dea76faab69cf16e3cfde10dc29c12"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Mon Sep 07 09:00:21 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 09:00:21 2026 +0530"
      },
      "message": "fix(javascript): honor declared element types for root container registration (#4013)\n\n## What was the error\nRegistering a root container with declared element types, e.g.\n`fory.register(Type.list(Type.float32()))`, silently returned the\ninternal any-typed container serializer. The declared generics were\ndiscarded: elements were written with dynamic dispatch instead of the\ndeclared type, so declared `float32`/`int64` semantics were lost at the\nroot while the same declaration worked as a struct field.\n\n## What this PR fixes\nA root `Type.list`/`Type.set`/`Type.map` with declared element types now\ngets a dedicated generated serializer, bound to the returned root\nserialize/deserialize pair. It is kept out of the type-id keyed registry\nso dynamic container dispatch stays untouched. Regression tests cover\nroot list, set, and map plus the dynamic-dispatch guard.\n\n---------\n\nCo-authored-by: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "1c2dab3371dea76faab69cf16e3cfde10dc29c12",
      "tree": "545761695da58560990960b178378d53af0102d2",
      "parents": [
        "8d1fad1535f39e042ee18a001d8ed4bc90fa5a0d"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Mon Sep 07 11:21:53 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 08:51:53 2026 +0530"
      },
      "message": "fix(release): correct JVM notices and C# license headers (#4026)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\n\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "8d1fad1535f39e042ee18a001d8ed4bc90fa5a0d",
      "tree": "9194321023059bb7c2ac0e4f0803926f2a535a81",
      "parents": [
        "63999d5445648cfe3dcf7a556bace33c3b41436f"
      ],
      "author": {
        "name": "Pigsy-Monk",
        "email": "zwsong@trip.com",
        "time": "Mon Sep 07 11:06:43 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 08:36:43 2026 +0530"
      },
      "message": "fix(core): keep TypeDef root kind consistent for factory custom serializers (#4022)\n\n## What does this PR do?\n\nFixes #4021.\n\nA fresh reader can infer a struct kind for a plain class whose\nconfigured\n`SerializerFactory` actually supplies an extension serializer. Native\nTypeDef\nvalidation then rejects bytes written by an identically configured\ninstance.\n\nResolve empty extension roots through the existing\n`ClassResolver.getTypeInfo`\npath before validating their kind. The resolver retains the actual\nserializer\nand type ID, including when metadata previously created a provisional\nTypeInfo.\nThis requires no additional cache or factory probe.\n\nKeep each serializer\u0027s root definition on `TypeInfo`, independently of\nthe class\nfield schemas used by metadata probes and ObjectStream layers.\nLocal-header\nmatching checks an available root definition before the field schema,\nwithout\ncreating a serializer just to probe for a match. This preserves cold\nregistered\nstruct and ObjectStream layer matches and prevents a cached field schema\nfrom\nreplacing an extension\u0027s empty root definition.\n\n## Tests\n\nExpanded `SerializerFactoryTest` covers the original polymorphic custom\nserializer,\nmetadata-first and typed-root reads, read-then-write reuse, enum and\nrecursive\nstruct factories, factory failure recovery, registration, and both\ncodegen modes.\nIt also verifies that each custom serializer is created once per\nresolver.\n\n- Full `fory-core` suite on JDK 21: 2,252 passed, 58 skipped, no\nfailures or errors.\n- Includes cold native ID/name registration and typed/dynamic reads,\nverifying\nthat exact-local schemas do not consume the remote-schema allowance,\nplus\nexisting ObjectStream layer, registration, and schema-consistent\nmeta-share cases.\n- Local cross-language peer tests were not run; the change preserves the\nnative wire format.\n- Spotless and Checkstyle passed.\n\n---------\n\nCo-authored-by: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\nCo-authored-by: chaokunyang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "63999d5445648cfe3dcf7a556bace33c3b41436f",
      "tree": "244e7aff04dd1ab1d150363f25213837395481aa",
      "parents": [
        "b323a1bf5b8de14b516603ee643da822ff0c5ed5"
      ],
      "author": {
        "name": "Leo",
        "email": "lskleo@163.com",
        "time": "Mon Sep 07 06:58:53 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 04:28:53 2026 +0530"
      },
      "message": "test(java): assert non-ASCII meta encoding failures (#4025)\n\n## What changes\n\nMake the non-ASCII meta string encoding test fail when the expected\nexception is not thrown.\n\nThe previous try/catch structure only performed the assertion when an\nexception was raised, so the test could pass silently if the encoder\nunexpectedly accepted the input.\n\n## Tests\n\n- `mvn -T2 -pl fory-core -am\n\"-Dtest\u003dorg.apache.fory.meta.MetaStringTest\"\n\"-Dsurefire.failIfNoSpecifiedTests\u003dfalse\" test`\n- `mvn -pl fory-core spotless:check`"
    },
    {
      "commit": "b323a1bf5b8de14b516603ee643da822ff0c5ed5",
      "tree": "06b642b8d61cc9034760285c3304145220733f8a",
      "parents": [
        "80e9b576c84aba6fed54b6520d0c88ea11bf9172"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Sat Sep 05 20:15:35 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 05 17:45:35 2026 +0530"
      },
      "message": "perf(java): avoid compatible metadata probes on cache hits (#4023)\n\n## Why?\n\n\n\n## What does this PR do?\n\n\n\n## Related issues\n\nCloses #4020\n\n## AI Contribution Checklist\n\n\n\n- [ ] Substantial AI assistance was used in this PR: `yes` / `no`\n- [ ] If `yes`, I included a completed [AI Contribution\nChecklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)\nin this PR description and the required `AI Usage Disclosure`.\n- [ ] If `yes`, my PR description includes the required `ai_review`\nsummary and screenshot evidence or equivalent persisted links of the\nfinal clean AI review results from both fresh reviewers described in\n`AI_POLICY.md`, the Fory-guided reviewer and the independent general\nreviewer, on the current PR diff or current HEAD after the latest code\nchanges.\n\n\n\n## Does this PR introduce any user-facing change?\n\n\n\n- [ ] Does this PR introduce any public API change?\n- [ ] Does this PR introduce any binary protocol compatibility change?\n\n## Benchmark"
    },
    {
      "commit": "80e9b576c84aba6fed54b6520d0c88ea11bf9172",
      "tree": "3ae36d16219cdc72888ee9edbe8bda42aff0ba65",
      "parents": [
        "dd5e2e9676136b27b1a21aaeb60157d5cfc20aa7"
      ],
      "author": {
        "name": "Shawn Yang",
        "email": "shawn.ck.yang@gmail.com",
        "time": "Fri Sep 04 14:12:29 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 11:42:29 2026 +0530"
      },
      "message": "docs: update release version to 1.7.1 (#4018)\n\n## Summary\n\n- update released dependency and installation examples from 1.7.0 to\n1.7.1\n- update Rust badges and package tables\n- add Dart 1.7.1 changelog entries while keeping development metadata on\n1.8.0-dev\n\n## Validation\n\n- formatted all changed Markdown files with Prettier\n- verified user-facing docs contain no stale 1.7.0 or\ndevelopment-version references\n- verified active development metadata is unchanged\n- ran `git diff --check`\n- local tests and builds were not run; GitHub Actions owns test\nvalidation"
    },
    {
      "commit": "dd5e2e9676136b27b1a21aaeb60157d5cfc20aa7",
      "tree": "1fa57832c8a8ee07d4e1972ea1265adbcc129375",
      "parents": [
        "a18b41b3fbbac4ef50990910a7b0ddc70a26e453"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Thu Sep 03 12:13:49 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 12:13:49 2026 +0530"
      },
      "message": "fix(javascript): accept user type id 0 in struct, ext, and enum factories (#4014)\n\n## What was the error\n`Type.struct(0, ...)`, `Type.ext(0)`, and `Type.enum(0, ...)` threw\n`type name and type id should be set at least one` because a truthiness\ncheck treated the numeric id 0 as absent, although `TypeInfo` allows\nuser type ids in `[0, 0xfffffffe]`. A peer runtime registering a type\nunder id 0 could not interoperate with JavaScript.\n\n## What this PR fixes\nThe three factories now check `typeId \u003d\u003d\u003d undefined` instead of\ntruthiness, so id 0 registers normally. A regression test covers all\nthree factories and a full serialize/deserialize round trip under id 0.\n\n---------\n\nCo-authored-by: Shawn Yang \u003cshawn.ck.yang@gmail.com\u003e"
    },
    {
      "commit": "a18b41b3fbbac4ef50990910a7b0ddc70a26e453",
      "tree": "a236f75f08885b611a8b20ee89f9a1a4714bb095",
      "parents": [
        "6489d94f0d7010d58c9d738da69722abe4c0d076"
      ],
      "author": {
        "name": "Ayush Kumar",
        "email": "ayush.2007.iit@gmail.com",
        "time": "Thu Sep 03 11:34:45 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 11:34:45 2026 +0530"
      },
      "message": "fix(javascript): truncate meta string dispose list on write reset (#4015)\n\n## What was the error\n`MetaStringWriter.reset()` restored each entry\u0027s `dynamicWriteStringId`\nbut never truncated `disposeMetaStringBytes`. Since meta string owners\nre-push themselves on every root serialization of a named type, the list\ngrew by every past root operation (an unbounded leak in long-running\nprocesses) and each reset walked the whole history.\n\n## What this PR fixes\n`reset()` now truncates the list after restoring the ids, so it only\never holds the current root\u0027s entries. A regression test asserts the\nlist stays at its baseline size across 100 root serializations."
    }
  ],
  "next": "6489d94f0d7010d58c9d738da69722abe4c0d076"
}